Run Cloudflare's security-audit skill in Next.js

The skill reads source. It does not, by itself, open your deployed URL. The skill file says not to probe deployed endpoints, and to leave a lead as needs_validation when the decisive fact is outside the repository. A missing header on the live site can stay unconfirmed until you check the response yourself.

Read findings.json by the verdict names in the README. confirmed has a source trace and an observed result. needs_validation has an unresolved fact and no severity. rejected was disproved. Do not treat needs_validation as a vulnerability, and do not merge a change the agent describes. The skill file says the audit describes fixes and does not modify the target.