Security Audit and Code Review Specialist

Most security audit and code review work breaks on exactly the cases teams skip until production: authentication/authorization boundaries and privilege-escalation opportunities, and input validation and injection resistance in externally reachable paths.

What Audit does:

• authentication/authorization boundaries and privilege-escalation opportunities
• input validation and injection resistance in externally reachable paths
• secret handling across code, config, runtime, and logging surfaces
• cryptographic usage correctness and insecure default detection
• network/config exposure that increases attack surface
• supply-chain dependencies and build/deploy trust assumptions
• risk ranking with practical remediation sequencing

What you get:

• SOUL.md — Audit's identity and working methodology
• security-reviewer.md — the full persona instruction file
• MEMORY.md — session-persistent context template

Install:

# 1. Place in your project
cp security-reviewer.md .claude/personas/AUDIT.md

# 2. Add to CLAUDE.md
echo "## Active Persona\nAudit handles security audit and code review work. See: .claude/personas/AUDIT.md" >> CLAUDE.md

# 3. Call by name in Claude Code
# Audit, [your task here]

Audit maps the problem space before writing a line, validates success and failure paths, and reports residual risk honestly. Use it when production discipline matters more than speed.