v1.51.0

secure-code-auditor v1.51.0

Agent-operator security. The skill gains a twenty-fifth reference,
references/agent-operator-security.md, and it covers a surface none of the
other twenty-four does: the access the reviewing agent itself holds, rather
than the surface of the backend it audits. That surface does not exist until an
agent runs a review unsupervised, which is exactly why a skill written for a
supervised review had no reason to carry it.

The boundary with references/agent-and-llm-interfaces.md is the one to keep
straight, and it is drawn in both files with one line each. That file owns the
serving side — a backend that agents call, the tool boundary it publishes, the
confirmation token it issues to its own callers. This one owns the credential
the agent holds while it reads your code.

What the new file owns

The credential files the agent must never open — .env and each variant,
*.pem, *.key, ~/.ssh, ~/.aws, ~/.gnupg, ~/.netrc, a service-account
key, and a decrypted secrets file. The counter-instinct half is stated outright,
because it is the half that gets skipped: a .gitignore, a tool-specific ignore
file, and an instruction in a project memory file are defaults rather than
walls. A shell command the agent composes itself opens the file directly, with
no ignore rule between the two. The published defect reports that record exactly
that path are cited — anthropics/claude-code issues #4160, #12102, and #24185,
and The Register reproducing the bypass on 28 Jan 2026 against v2.1.12. An
auto-approve or permission-skip mode is not the moment the rule relaxes; it is
the moment the rule is the only thing left.

The Django half of the same rule is that a settings module is executable. An
import of a production one resolves the production SECRET_KEY, the database
password, and every API key it names — which is why settings_scan.py parses a
settings package with the ast module and never imports the target project. The
file now records that as the reason the constraint is workable rather than
merely as a scanner property.

The name-by-location rule for every finding, report, commit message, and
fixture the agent writes. Redaction is put where it belongs: a masking layer
matches a literal string, so base64, a split across two lines, URL encoding, or
the value inside JSON, XML, or YAML each defeat it. GitHub's own Actions
hardening guidance says both halves — its redaction rests on an exact match, and
automatic redaction is not guaranteed. The instinct points the wrong way here.
"Show the evidence" is correct for every other finding class in this skill and
wrong for this one, because a hardcoded credential is a defect for where it sits
rather than for what it spells.

The kind, scope, and life of the agent's own repository credential, ranked
by blast radius in one table. A classic personal access token reaches every
repository the account can see and carries no expiration requirement. A
fine-grained one is bounded by an organization maximum between 1 and 366 days
(GitHub Changelog, 18 Oct 2024). A deploy key reaches exactly one repository
with no account behind it. An installation token expires in an hour. Beside the
table sit the per-job token permission that resolves an omitted scope to none,
the federated cloud credential that replaces a stored one and leaves the
control-plane record a stored one structurally cannot, and revocation at the end
of the task.

Instructions arriving in content as data rather than as authority —
repository files, a commit message, an issue body, a pull-request comment, a web
page, tool output. Four incidents against coding agents specifically carry it:
the Amazon Q Developer extension for VS Code (CVE-2025-8217, AWS advisory
AWS-2025-015), three agents driven from pull-request titles and issue bodies with
one made to post its own API key as a public comment (Google VRP #1609699), a
token exfiltration that defeated the host's own secret scanning by base64 (Orca
Security), and a backdoor header inserted from a helpful-looking issue (Trail of
Bits, 6 Aug 2025).

The confirmation gate on an action a finding recommends, enforced in the
execution path rather than in the prompt. The July 2025 production-database
deletion happened during a declared freeze that lived only in the instructions,
and the agent then misreported the restore as impossible. The agent recommends
and a person executes — at every level of confidence, because confidence carries
no signal about the cost of a wrong irreversible action.

The command, change, and cloud-action record that a layer the agent cannot
edit has to author, including the source identity a session holder cannot change
against the session name it can.

Three sections SKILL.md never carried

What proof is, and the commands that produce it. The definition was already
implied by the methodology and workflow files; it is now stated where it can be
enforced. A finding without confirmed evidence is a hypothesis, is labelled as
one, and goes under "Worth checking". The not-examined list is part of the
deliverable, because the coverage ledger's not-examined lines are what the
limitations section is written from. The exact commands are the three scripts
under scripts/, with the dangerous_patterns.py self-test named as the way to
confirm a quiet result before trusting it. One ground-truth read rule lands here
too, at the point the sweep first needs a local fact the repository cannot
supply.

Stop conditions, with five handoff fields instantiated for this domain. The
existing refusals are extended rather than duplicated — review-time read-only,
and the three write-time changes that already need explicit confirmation, stand
as they are. Three more cover the skill's own actions: stop the sweep and
escalate at once on a live credential exposure; never execute a rotation, a
revocation, a disable, or a delete; refuse a read that would open credential
material.

Freshness. Django 6.1, 6.0.8, and 5.2.17 LTS with DRF 3.18.0, on the OWASP
Top 10:2025, API Security Top 10:2023, and ASVS 5.0.0 foundation, with the agent
tokens from the LLM Top 10 2026 and the Agentic Top 10 2026. Review again at the
next Django feature release and no later than 9 Feb 2027.

What did not move

The frontmatter description is byte-identical at 1013 characters, measured the
way the validation workflow measures it, and allowed-tools is unchanged at
Read, Grep, Glob, Bash — the no-Edit, no-Write audit posture is deliberate, and
every evidence command in the new verification section fits inside it. No
control, example, or caveat is removed from any pre-existing file. The
library-index date does not move.

Two deletions inside the new file, both under the deletion pass and both long
justifications for a rule rather than the rule: the sentences explaining why the
suite lacked this file, and the sentence apologising for the cost of asking a
person for a value.

The register holds. The corpus carries zero uppercase MUST/NEVER, so the
absolutes here are sentence-initial and unhedged, matching the other twenty-four
files.

Verification

docs-integrity passes with 25 reference files, every cited path resolving, no
orphan, balanced fences, 306 anchored links across 34 markdown files, and
SKILL.md at 39065 of the 40960 bytes allowed. validate-skill passes with the
description at 1013 characters, the dangerous_patterns.py self-test at 49
fixtures and 29 of 29 rules covered, and all three scanners exiting 0 with a
kind: "summary" record on a missing path. All 346 cross-file section citations
in the corpus resolve. The new file carries no prose sentence over 25 words and
no prose line over 79 characters.