claude-audit-20

Twenty-pass verification gate for any code change. Covers injection, authentication, authorization/IDOR, secrets exposure, error handling, concurrency, resource leaks, data access/N+1, algorithmic hot paths, unbounded memory growth, external-call resilience, idempotency, transaction consistency, config hardening, supply chain, observability, API contracts, cross-module contracts, test gaps, and a mandatory final false-positive filter. Use this skill EVERY time coding work is being wrapped up - after implementing a feature, fixing a bug, refactoring, generating code, before any commit/PR/deploy, and before telling the user the work is done. Also use when the user says audit, verify, review, harden, "denetle", "doğrula", "20 doğrulama", "20/20" or "audit-20". Coding work does not count as finished until it passes this gate 20/20.

The write-time companion to audit-20: the same twenty failure classes, applied as rules WHILE writing code instead of hunted afterwards. Load before touching code on any coding task (feature, fix, refactor, generated code). Not an audit; spawns no agents and no fleet, costs no extra tokens; its job is to make the final audit-20 run come back mostly CLEAN. Trigger: writing code, implement, fix, refactor, "guard-20", "coding rules".