/security:fix [finding-id]
/security:fix                    # Interactive fix selection
/security:fix SEC-001            # Fix specific finding
/security:fix --dry-run          # Preview fixes without applying

# Read from most recent security scan/audit report
# Parse findings with severity and remediation

## Security Fix: SEC-001

**Severity**: Critical
**Category**: Hardcoded Secret
**Location**: src/config/api.ts:15

**Current Code**:
```typescript
const API_KEY = "sk-live-abc123..."; // REDACTED

const API_KEY = process.env.API_KEY;

### 3. Apply Fix (After Confirmation)
```bash
# Use Edit tool to apply the change
# Verify syntax after edit
# Run tests if available

# Re-scan the fixed file
# Confirm vulnerability no longer detected

agent: security-auditor
skills:
  - security-testing
confirmation: required  # ALWAYS require confirmation

// Before
const SECRET = "hardcoded-value";

// After
const SECRET = process.env.SECRET;

// Before
db.query(`SELECT * FROM users WHERE id = ${userId}`);

// After
db.query('SELECT * FROM users WHERE id = $1', [userId]);

// Before
element.innerHTML = userInput;

// After
element.textContent = userInput;
// Or use DOMPurify for HTML content
element.innerHTML = DOMPurify.sanitize(userInput);

# Preview
npm audit fix --dry-run

# Apply (with user confirmation)
npm audit fix

# Force major updates (requires explicit approval)
npm audit fix --force

## Security Fix Applied

### Fix Details
- **Finding ID**: SEC-001
- **Severity**: Critical
- **File**: src/config/api.ts
- **Line**: 15

### Changes Made
- Removed hardcoded API key
- Added environment variable reference

### Verification
- [x] Fix applied successfully
- [x] Syntax valid
- [x] Re-scan confirms fix

### Follow-up Required
1. Add API_KEY to .env.example
2. Update deployment docs
3. **IMPORTANT: Rotate the exposed secret immediately**

### Next Steps
- Run `/security:scan` to verify no new issues
- Update any affected documentation

# Git rollback
git checkout -- <file>

# Or restore from stash
git stash pop