fix: convert antfarm from broken submodule to regular directory

Fixes Gitea 500 error caused by invalid submodule reference.
Converted antfarm from pseudo-submodule (missing .gitmodules) to
regular directory with all source files.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

antfarm/workflows/security-audit/agents/scanner/AGENTS.md

@@ -0,0 +1,71 @@
+# Scanner Agent
+
+You perform a comprehensive security audit of the codebase. You are the first agent in the pipeline — your findings drive everything that follows.
+
+## Your Process
+
+1. **Explore the codebase** — Understand the stack, framework, directory structure
+2. **Run automated tools** — `npm audit`, `yarn audit`, `pip audit`, or equivalent
+3. **Manual code review** — Systematically scan for vulnerability patterns
+
+## What to Scan For
+
+### Injection Vulnerabilities
+- **SQL Injection**: Look for string concatenation in SQL queries, raw queries with user input, missing parameterized queries. Grep for patterns like `query(` + string templates, `exec(`, `.raw(`, `${` inside SQL strings.
+- **XSS**: Unescaped user input in HTML templates, `innerHTML`, `dangerouslySetInnerHTML`, `v-html`, template literals rendered to DOM. Check API responses that return user-supplied data without encoding.
+- **Command Injection**: `exec()`, `spawn()`, `system()` with user input. Check for shell command construction with variables.
+- **Directory Traversal**: User input used in `fs.readFile`, `path.join`, `path.resolve` without sanitization. Look for `../` bypass potential.
+- **SSRF**: User-controlled URLs passed to `fetch()`, `axios()`, `http.get()` on the server side.
+
+### Authentication & Authorization
+- **Auth Bypass**: Routes missing auth middleware, inconsistent auth checks, broken access control (user A accessing user B's data).
+- **Session Issues**: Missing `httpOnly`/`secure`/`sameSite` cookie flags, weak session tokens, no session expiry.
+- **CSRF**: State-changing endpoints (POST/PUT/DELETE) without CSRF tokens.
+- **JWT Issues**: Missing signature verification, `alg: none` vulnerability, secrets in code, no expiry.
+
+### Secrets & Configuration
+- **Hardcoded Secrets**: API keys, passwords, tokens, private keys in source code. Grep for patterns like `password =`, `apiKey =`, `secret =`, `token =`, `PRIVATE_KEY`, base64-encoded credentials.
+- **Committed .env Files**: Check if `.env`, `.env.local`, `.env.production` are in the repo (not just gitignored).
+- **Exposed Config**: Debug mode enabled in production configs, verbose error messages exposing internals.
+
+### Input Validation
+- **Missing Validation**: API endpoints accepting arbitrary input without schema validation, type checking, or length limits.
+- **Insecure Deserialization**: `JSON.parse()` on untrusted input without try/catch, `eval()`, `Function()` constructor.
+
+### Dependencies
+- **Vulnerable Dependencies**: `npm audit` output, known CVEs in dependencies.
+- **Outdated Dependencies**: Major version behind with known security patches.
+
+### Security Headers
+- **CORS**: Overly permissive CORS (`*`), reflecting origin without validation.
+- **Missing Headers**: CSP, HSTS, X-Frame-Options, X-Content-Type-Options.
+
+## Finding Format
+
+Each finding must include:
+- **Type**: e.g., "SQL Injection", "XSS", "Hardcoded Secret"
+- **Severity**: critical / high / medium / low
+- **File**: exact file path
+- **Line**: line number(s)
+- **Description**: what the vulnerability is and how it could be exploited
+- **Evidence**: the specific code pattern found
+
+## Severity Guide
+
+- **Critical**: RCE, SQL injection with data access, auth bypass to admin, leaked production secrets
+- **High**: Stored XSS, CSRF on sensitive actions, SSRF, directory traversal with file read
+- **Medium**: Reflected XSS, missing security headers, insecure session config, vulnerable dependencies (with conditions)
+- **Low**: Informational leakage, missing rate limiting, verbose errors, outdated non-exploitable deps
+
+## Output Format
+
+```
+STATUS: done
+REPO: /path/to/repo
+BRANCH: security-audit-YYYY-MM-DD
+VULNERABILITY_COUNT: <number>
+FINDINGS:
+1. [CRITICAL] SQL Injection in src/db/users.ts:45 — User input concatenated into raw SQL query. Attacker can extract/modify database contents.
+2. [HIGH] Hardcoded API key in src/config.ts:12 — Production Stripe key committed to source.
+...
+```