pre-ship-security-red-team

Authorized, evidence-driven security red-team pass over a web app you own before launch, run by three parallel read-only subagents with synthetic test accounts. Covers anonymous data access, IDOR cross-user object access, self-service role escalation, password-reset token reuse, UI-disabled request bypass, quota and free-tier bypass, concurrent quota races, hostile form input, open redirects, stored XSS, SSRF in URL-fetching features, private-response and cache isolation, preview deployment exposure, and prompt injection through ingested AI content. Then fixes each failure, reruns with a negative control and emits a before/after verdict table. Use when someone says "play the bad guy before we ship", "red team my site", "test my auth and rate limits", "is my vibe-coded site safe to launch", or after adding login, roles, credits, uploads, or AI ingestion. Local or isolated environments only. Not for production, or for a passive exposure check (use web-preflight).