construct-scar

Scan for PII exposure in API responses, committed files, grimoires, and data flow paths.

Scan for secret leakage in env files, client code, git history, and build artifacts.

API endpoint security surface scan — auth gates, data exposure, rate limiting, input validation.

Audit authentication flow completeness — login, refresh, logout, session, RBAC, middleware.

Map impact surface of a change or regression by tracing data flow through every consumer.

Generate defensive measure specifications from a PMR — test specs, types, error boundaries, checklists.

Create a structured Postmortem Record from an incident, mining git history and issues for timeline and blast radius.

Verify hardening measures from past PMRs still hold by checking tests, types, and error boundaries.

Rapid severity assessment connecting user reports to affected code with blast radius estimate.

Detect patterns across multiple PMRs — recurring root causes, repeat blast radius files, persistent signal gaps.

Audit monitoring, test, type, and error handling coverage for a scope and identify gaps.