White-box, OSWE-style security audit for Claude Code: traces source→sink, chains findings to unauthenticated RCE, verifies each chain, and writes an evidence-backed Markdown + HTML report. PHP · Node · Python · Java · .NET.