docs: record the language pass and bump to v1.50.0

Convert the SKILL.md prose to ASD-STE100 and carry the same conversion into
the AGENTS.md, GEMINI.md, and .cursor cascade, on each line that holds
guidance of its own. No pointer, path, or file name moves in any of the
three, and the router table, the ownership table, and every reference row
are untouched.

The frontmatter description is byte-identical at 1013 characters, measured
the way the validation workflow measures it. SKILL.md is 33860 of the 40960
bytes the docs-integrity workflow allows. Every heading is unchanged, so all
297 anchored links across the repository still resolve.

The changelog row releases the whole range since v1.49.0 rather than this
session alone: the boundary scrub, then language pass waves 1, 2, and 3. The
version is applied in SKILL.md frontmatter and in the four issue-template
placeholders that track it.

Author: n-shadloo

.cursor/rules/secure-code-auditor.mdc

@@ -3,43 +3,38 @@ description: Backend security review and secure-by-default coding, Django/DRF-fi
 alwaysApply: false
 ---
 
-When doing backend security review or writing backend code in this repo, use the
+When you review backend security or write backend code in this repo, use the
 skill defined in `SKILL.md` at the repo root as the source of truth. Read
 `SKILL.md` first for the router and mode logic, then open the relevant
 `references/*.md` file(s). At review-time read `01-audit-workflow.md` before
 any topic file: it owns the sweep — the phase order and what each phase hands
-the next, the entry-point inventory
-that has to be enumerated from declarations rather than from a generated
-schema, the principals and boundaries, hypothesis ordering, the budget rule
-that enumerates a tree too large to read closely in full and rations only the
-close reading, the six-item gate
-a hypothesis discharges before it is written as a finding together with the
-benign Django and DRF patterns it rules out, the coverage
-ledger that keeps examined-and-clean apart from not-examined and is read back
-at each phase boundary rather than recalled, and the WSTG
-mapping at section granularity naming which testing-guide sections the sweep
-covers and which are declared non-goals — and the topic
-files answer the questions that sweep raises. The router is grouped — OWASP
-spine, cross-cutting
-surfaces, package decisions — and the "Ownership and boundaries" section below
-it names the single owning file whenever two rows could both match, as a table
-of topic, owner, and deciding distinction with three splits kept in prose, so
-read that before assuming a topic is duplicated.
-Review-time produces prioritized findings (severity,
-location, CWE + OWASP mapping, an optional ASVS 5.0 chapter or WSTG section
-where the project is held to that standard, the confirmed source-to-sink path
-and the protection
-that failed, fix); write-time applies the secure-default
-contract and closes with a short security-decisions note rather than a findings
-report. Each write-time rule sits beside the control it completes in the
-reference file, so the file you opened for the concern already carries the rule
-for writing it. The methodology, both output formats, the severity rubric
-including how a race and a surviving-personal-data failure are rated, the
-baseline severity table beneath it that makes an ordinary finding class
-reproducible between runs, the ASVS
-chapter mapping and its declared non-goals, and the rule for a secure default
-that conflicts with the request are in
-`references/00-methodology-and-severity.md`.
+the next, the entry-point inventory that has to be enumerated from declarations
+rather than from a generated schema, the principals and boundaries, hypothesis
+ordering, the budget rule that enumerates a tree too large to read closely in
+full and rations only the close reading, the six-item gate a hypothesis
+discharges before it is written as a finding together with the benign Django
+and DRF patterns it rules out, the coverage ledger that keeps
+examined-and-clean apart from not-examined and is read back at each phase
+boundary rather than recalled, and the WSTG mapping at section granularity
+naming which testing-guide sections the sweep covers and which are declared
+non-goals — and the topic files answer the questions that sweep raises. The
+router is grouped — OWASP spine, cross-cutting surfaces, package decisions —
+and the "Ownership and boundaries" section below it names the single owning
+file whenever two rows could both match, as a table of topic, owner, and
+deciding distinction with three splits kept in prose, so read that before
+assuming a topic is duplicated. Review-time produces prioritized findings
+(severity, location, CWE + OWASP mapping, an optional ASVS 5.0 chapter or WSTG
+section where the project is held to that standard, the confirmed
+source-to-sink path and the protection that failed, fix); write-time applies
+the secure-default contract and closes with a short security-decisions note
+rather than a findings report. Each write-time rule sits beside the control it
+completes in the reference file, so the file you opened for the concern already
+carries the rule for writing it. The methodology, both output formats, the
+severity rubric including how a race and a surviving-personal-data failure are
+rated, the baseline severity table beneath it that makes an ordinary finding
+class reproducible between runs, the ASVS chapter mapping and its declared
+non-goals, and the rule for a secure default that conflicts with the request
+are in `references/00-methodology-and-severity.md`.
 
 Treat the privilege model and object-/field-level authorization, impersonation
 and break-glass access, OAuth2/OIDC and social login, API-key lifecycle/scoping,
@@ -121,9 +116,9 @@ view — it carries the inventory of every sink and the reference that owns each
 one — and the security-hardening library index for dated package
 dispositions.
 
-Read-only triage scripts are in `scripts/`; all three parse with the `ast`
-module rather than grepping lines, so a hit is a structural match carrying the
-reference file that owns it, `entrypoint_inventory.py` enumerates the declared
+Read-only triage scripts are in `scripts/`. All three parse with the `ast`
+module rather than match lines, so a hit is a structural match that carries the
+reference file that owns it. `entrypoint_inventory.py` enumerates the declared
 entry points a sweep starts from, and `settings_scan.py` reads a settings
 package rather than a single module. Do not rely on this summary alone — read
 the referenced files.

.github/ISSUE_TEMPLATE/01-bug.yml

@@ -22,7 +22,7 @@ body:
     attributes:
       label: Skill version
       description: The value of metadata.version in SKILL.md.
-      placeholder: 1.49.0
+      placeholder: 1.50.0
     validations:
       required: true
   - type: textarea

.github/ISSUE_TEMPLATE/02-correction.yml

@@ -20,7 +20,7 @@ body:
     attributes:
       label: Skill version
       description: The value of metadata.version in SKILL.md.
-      placeholder: 1.49.0
+      placeholder: 1.50.0
     validations:
       required: true
   - type: textarea

.github/ISSUE_TEMPLATE/03-coverage.yml

@@ -29,7 +29,7 @@ body:
     attributes:
       label: Skill version
       description: The value of metadata.version in SKILL.md.
-      placeholder: 1.49.0
+      placeholder: 1.50.0
     validations:
       required: true
   - type: textarea

.github/ISSUE_TEMPLATE/04-library-index.yml

@@ -57,7 +57,7 @@ body:
     attributes:
       label: Skill version
       description: The value of metadata.version in SKILL.md.
-      placeholder: 1.49.0
+      placeholder: 1.50.0
     validations:
       required: true
   - type: dropdown

AGENTS.md

@@ -1,14 +1,14 @@
 # AGENTS.md
 
 This repository is a backend security skill. Its canonical instructions live in
-`SKILL.md`, which routes to the topic files under `references/`. Any agent
-working in this repo should load `SKILL.md` first and then read only the
+`SKILL.md`, which routes to the topic files under `references/`. An agent that
+works in this repo should load `SKILL.md` first, and then read only the
 `references/*.md` file(s) relevant to the task.
 
 Primary integration: **Claude** (Anthropic Agent Skills). The files below let
-other agents use the same content; they are pointers, not copies. If anything
-here disagrees with `SKILL.md`, `SKILL.md` wins. The current version is recorded
-in `SKILL.md` frontmatter (`metadata.version`).
+other agents use the same content. They are pointers, not copies. If anything
+here disagrees with `SKILL.md`, `SKILL.md` wins. The current version is
+recorded in `SKILL.md` frontmatter (`metadata.version`).
 
 ## What this skill does
 Reviews backend code for security issues and applies secure defaults while
@@ -177,63 +177,65 @@ read differently because one calls `getlist` and the other subscripts the
 - Review-time: audit existing code, produce prioritized findings (severity,
   location, CWE + OWASP mapping, an optional ASVS 5.0 chapter, WSTG section, or
   LLM/Agentic Top 10 entry token where the project is actually held to that
-  standard, the
-  shortest source-to-sink path the finding was confirmed on together with the
-  protection that failed, concrete fix). Read-only by default. Load
-  `references/01-audit-workflow.md` before any topic file; it owns the sweep
-  the findings are produced by, and the topic files answer the questions that
-  sweep generates.
-- Write-time: apply the standing secure-default contract while generating code,
-  apply the secure default where it conflicts with the request and say so, and
-  close with a short security-decisions note rather than a findings report. The
-  rule for each generation moment sits beside the control it completes, in the
-  reference the router already sends you to, so opening a file for the concern
-  loads the rule for writing it.
-Mode selection, both output formats, the severity rubric including how a race
-and a surviving-personal-data failure are rated, the baseline severity table
-that makes an ordinary finding class reproducible between runs while the rubric
-keeps deciding the borderline one, the ASVS 5.0 chapter mapping with the
-chapters this skill treats as non-goals, the conflict rule, and the convention
-that every control is stated in a review form and a write-time form together
-are defined in `references/00-methodology-and-severity.md`.
+  standard, the shortest source-to-sink path the finding was confirmed on
+  together with the protection that failed, concrete fix). Read-only by
+  default. Load `references/01-audit-workflow.md` before any topic file. It
+  owns the sweep that produces the findings, and the topic files answer the
+  questions that sweep generates.
+- Write-time: apply the standing secure-default contract while you generate
+  code. Apply the secure default where it conflicts with the request, and say
+  so. Close with a short security-decisions note rather than a findings report.
+  The rule for each generation moment sits beside the control it completes, in
+  the reference the router already sends you to. A file opened for the concern
+  therefore loads the rule for writing it. Mode selection, both output formats,
+  the severity rubric including how a race and a surviving-personal-data
+  failure are rated, the baseline severity table that makes an ordinary finding
+  class reproducible between runs while the rubric keeps deciding the
+  borderline one, the ASVS 5.0 chapter mapping with the chapters this skill
+  treats as non-goals, the conflict rule, and the convention that every control
+  is stated in a review form and a write-time form together are defined in
+  `references/00-methodology-and-severity.md`.
 
 ## How to use the content
 1. Read `SKILL.md` for the router, mode logic, and severity summary.
 2. At review-time, read `references/01-audit-workflow.md` next and run its
-   phases; the entry-point inventory decides which topic files are needed and
+   phases. The entry-point inventory decides which topic files are needed, and
    the coverage ledger records what each pass reached. That file also carries
-   the WSTG mapping at section granularity, which says which testing-guide
-   sections this sweep covers and which are declared non-goals rather than
-   gaps.
+   the WSTG mapping at section granularity. That mapping says which
+   testing-guide sections this sweep covers, and which are declared non-goals
+   rather than gaps.
 3. Open the `references/*.md` file(s) for the concern in front of you. The
    router is grouped — the OWASP Top 10:2025 spine, then cross-cutting
    surfaces, then package decisions — so pick the group, then the row.
 4. Where two rows could both match, the "Ownership and boundaries" section
-   below the router names the single owning file for each contested topic, as a
-   table of topic, owner, and the distinction that decides a case near the
-   boundary; three splits keep a paragraph because a row would misstate the
+   below the router names the single owning file for each contested topic. It
+   is a table of topic, owner, and the distinction that decides a case near the
+   boundary. Three splits keep a paragraph, because a row would misstate the
    axis they turn on. Every other file cross-references the owner rather than
-   restating its rules, and each reference file repeats its own half of that
+   restates its rules, and each reference file repeats its own half of that
    rule in its opening paragraph.
 5. Optional read-only triage (standard library only, no network; `--json` on any
    of the three is JSON Lines, one object per line, consumed a record at a time):
    - `python scripts/entrypoint_inventory.py path/to/project --settings path/to/settings --json`
    - `python scripts/settings_scan.py path/to/settings/ --json`
    - `python scripts/dangerous_patterns.py path/to/project`
    - `python scripts/dangerous_patterns.py path/to/project --json --min-severity MEDIUM`
-   - `python scripts/dangerous_patterns.py --selftest`
-All three parse with the `ast` module rather than grepping lines, so a hit is a
-structural match rather than a text one, every row names the reference file that
-owns it, a `dangerous_patterns.py` hit additionally carries a stable rule
-identifier, and a file that fails to parse is reported as unparsed rather than
-skipped in silence. Every `--json` stream ends with one `kind: "summary"`
-record, so an empty stream never occurs. The inventory enumerates the declared entry points the sweep
-starts from — routes at their include-resolved prefix, routers and actions,
-Ninja, GraphQL, gRPC, Channels, Celery, commands, signals, admin, middleware —
-marking each HTTP-reachable row as declaring its authorization, inheriting it,
-or having none, and the settings scan reads a whole settings package rather than
-one module, naming which module each effective value came from. Treat script
-output as leads to verify, not confirmed findings.
+   - `python scripts/dangerous_patterns.py --selftest` All three parse with the
+     `ast` module rather than match lines, so a hit is a structural match
+     rather than a text one. Every row names the reference file that owns it. A
+     `dangerous_patterns.py` hit also carries a stable rule identifier. A file
+     that fails to parse is reported as unparsed rather than skipped in
+     silence. Every `--json` stream ends with one `kind: "summary"` record, so
+     an empty stream never occurs.
+
+     The inventory enumerates the declared entry points the sweep starts from —
+     routes at their include-resolved prefix, routers and actions, Ninja,
+     GraphQL, gRPC, Channels, Celery, commands, signals, admin, middleware. It
+     marks each HTTP-reachable row as one of three states: it declares its
+     authorization, it inherits it, or it has none. The settings scan reads a
+     whole settings package rather than one module, and names which module each
+     effective value came from. Treat script output as leads to verify, not
+     confirmed findings.
 
 ## Tool-specific entry points
 - Claude Code: `SKILL.md` (native Agent Skill).

GEMINI.md

@@ -189,17 +189,17 @@ rule that a Go-binary tool such as Trivy, Grype, Syft, or cosign is documented
 as a CI pattern rather than tiered in an index that gates pip-installable
 dependencies.
 
-Primary integration is Claude; this file exists so Gemini CLI uses the same
-single source of truth. Modes (review-time / write-time), the severity rubric
-and how it rates a race and a surviving-personal-data failure, the baseline
-severity table under it that makes an ordinary finding class rate the same way
-between runs, the findings format including the evidence line every finding
-carries, the ASVS 5.0 chapter mapping and the chapters declared out of scope
-alongside the terms on which a WSTG section is admissible in the same optional
-position,
-the write-time secure-default contract with the security-decisions note it
-returns in place of a report, and the rule for a default that conflicts with
-the request are in `references/00-methodology-and-severity.md`. That file also
-indexes which reference carries the write-time rule for each generation moment;
-every rule itself lives beside the control it completes rather than in a list.
-The version is recorded in `SKILL.md` frontmatter (`metadata.version`).
+Primary integration is Claude. This file exists so that Gemini CLI uses the
+same single source of truth. Modes (review-time / write-time), the severity
+rubric and how it rates a race and a surviving-personal-data failure, the
+baseline severity table under it that makes an ordinary finding class rate the
+same way between runs, the findings format including the evidence line every
+finding carries, the ASVS 5.0 chapter mapping and the chapters declared out of
+scope alongside the terms on which a WSTG section is admissible in the same
+optional position, the write-time secure-default contract with the
+security-decisions note it returns in place of a report, and the rule for a
+default that conflicts with the request are in
+`references/00-methodology-and-severity.md`. That file also indexes which
+reference carries the write-time rule for each generation moment; every rule
+itself lives beside the control it completes rather than in a list. The version
+is recorded in `SKILL.md` frontmatter (`metadata.version`).