[HarunRRayhan]

New review cve-review, run with /audit cve; included in /audit security and /audit all.

• Known CVEs: osv-scanner and the ecosystem audits on every lockfile, with a reach check in the app's code and no invented advisory ids.
• Likely CVEs: end-of-life runtimes and frameworks, old or floating base images, unsupported cloud versions (Lambda, RDS, EKS), unpinned or vendored code, no update automation.
• EOL dates and the CISA known-exploited list are looked up only with consent; without it claims are marked unconfirmed. Image scans (trivy) are listed for the user, never run.
• Skill count 31 → 32 (installer, tests, docs). Checklist commands are guard-tested.

Tried on a copy of harun.dev: found laravel/framework v13.11.2 with five advisories (fixed in 13.30.0) and reach in the signed-URL and email-validation paths.

Tests: tests/run.sh 8/8, shellcheck clean.

Generated with Claude Code