{"agent":"claude","input":"Audit this Go service for security problems and write security-audit.md. First read go.mod, main.go, the Makefile, the linter config and the CI workflow, and record the Go version, the build and test commands, and what the project already checks. Start any database the service needs in the sandbox, build and run the service with the documented local command, create or sign in as the first user, and confirm it answers. Map the trust boundaries from the code: authentication and session middleware, CSRF, API key handling, CORS, cookie attributes, response security headers, proxy and client IP trust, outbound fetching of user-supplied URLs, file and media handling, and configuration defaults. For each, make real requests against the running service and read the existing tests, then record every finding with the file and line, one request that demonstrates it, its severity, and the fix. Run govulncheck and gosec and list their results, marking anything you could not reproduce as unconfirmed. Change no code and open no pull request.","resources":[{"url":"https://github.com/your-org/your-app"}]}