we are building Technical Debt / Security Auditor — like Scope Shield/Sandbox: scans a repo, scores files/modules by risk (complexity, staleness, missing tests, known vulnerable patterns), and outputs a prioritized "fix this first" backlog with effort estimates.