Nightly security review of this codebase

Save this as a skill named security-council. Run every night at [3:30] [TIMEZONE]. Read the codebase at [REPO PATH]. Read recent commits and error logs too. Use the model to read the code. A pattern list is not a substitute for reading. If [USE CURSOR] is yes, you may hand the read to the Cursor agent CLI and then summarize what comes back. If it is not, do the read yourself. Look at this repo from four angles: - Attack surface: what a hostile input could reach. - Protections: whether the checks you already have cover that path. - Sensitive data: whether keys, tokens, mail, or financial notes are handled in a way I would accept. - Practicality: whether a control would hold up on a real day, or only looks strict on paper. Send a numbered report to the [SECURITY] Telegram topic. Each item: what is wrong, why it matters, the file, and the fix. Describe the weakness. Do not include payloads, exploit steps, or proof-of-concept code. If a finding is severe enough that waiting until morning is a bad idea, send that one item as soon as you have it, in the same shape, and still include it in the full report. If I ask for a number, give the evidence: the file, the function, and the fix. If I say fix it, change only that item and show me the diff. If the repo looks fine, say so in one line. Do not manufacture findings.