---
description: Fix all CRITICAL severity security findings
argument-hint: "[project-path: defaults to .]"
allowed-tools: Read, Edit, Write, Bash, Grep, Glob
---

Remediate all CRITICAL severity findings with verification loop.

## Steps

1. **Load audit findings**
   - Read latest from `.vaspera/audit/*.json` (most recent by timestamp)
   - If no audit exists, run `/vaspera-audit` first
   - Filter findings where `severity === "critical"`

2. **Categorize critical findings**
   Critical categories:
   - Unhandled async/await (crashes)
   - Missing auth checks (unauthorized access)
   - Missing RLS policies (data leakage)
   - Hardcoded secrets (credential exposure)
   - Raw SQL injection (CWE-89)
   - dangerouslySetInnerHTML (XSS, CWE-79)
   - Publicly exposed endpoints
   - Missing CORS configuration

3. **For each finding**
   - Show file location with context (3 lines before/after)
   - Preview the fix (before/after diff)
   - Apply fix:
     - Auto-apply if pattern has `safeToAutoApply: true`
     - Otherwise, confirm with user
   - Run `npm run build` to verify no compile errors

4. **Verification loop**
   - After fixing a group of related findings, re-run the targeted scanner
   - Example: after fixing gitleaks findings, run gitleaks again
   - Confirm finding count decreased
   - If new findings appear (regressions), flag immediately

5. **Final report**
   - N critical findings fixed
   - M critical findings remaining (with reasons)
   - Any regressions introduced
   - Suggest `/vaspera-fix-high` as next step

## Important

- ALWAYS run `npm run build` after each fix to catch compile errors early
- NEVER skip the verification loop — re-scan to confirm fixes worked
- Stage changes but do NOT commit unless user requests
- If a fix requires manual intervention, explain why and provide guidance
