{"agent":"claude","input":"Audit this NestJS API for security problems without changing any code. Read src/main.ts, src/config/app.config.ts, src/auth/auth.controller.ts, src/auth/auth.service.ts, src/auth/config/auth.config.ts, src/auth/strategies/*.ts, src/users/users.controller.ts, src/files/infrastructure/uploader/local/files.module.ts and files.controller.ts, src/utils/validation-options.ts, docs/auth.md, docker-compose.yaml and env-example-relational first. Start the stack in the sandbox with docker compose and the example env file, register and confirm a user through the mail catcher, log in, and get an admin token from the seeded admin. Then test with real requests: repeated failed logins and forgot-password calls for rate limiting, registered versus unregistered emails for account enumeration, a foreign Origin header for CORS, tokens with a changed algorithm or no signature, refresh token reuse, password reset link reuse after a password change, an upload of a non-image renamed to .png, path traversal on the file download route, admin-only routes with an ordinary token, and the headers helmet sets with CSP disabled. Write security-audit.md: for each finding the file and line, the request that demonstrates it, the response, severity and fix, and a section listing the checks that passed. Change no code and open no pull request.","resources":[{"url":"https://github.com/your-org/your-app"}]}