Built a codebase security vulnerability scanner

Confidently-wrong crypto, broken auth, injection, insecure deserialization, race conditions — the bugs traditional scanners miss because the code reads clean. High-severity findings block the merge.