security-scan-workflow

Automated security scanning workflow using Semgrep MCP. Scans changed files for OWASP Top 10 vulnerabilities, CWE patterns, hardcoded secrets, and security misconfigurations. Returns prioritized findings with remediation guidance. Use when security validation is needed for code changes (invoked by security-engineer, code-quality-validator, or /audit command). Scans only changed files for efficiency (10-15s overhead).