Initial project scaffold: macOS package security audit tool

This commit establishes the foundation for a comprehensive security audit
tool for macOS developer machines. It audits all installed software,
detects vulnerabilities via OSV.dev, and provides Claude-powered
mitigation recommendations.

## Architecture

- System inventory collection (Homebrew, pip, npm, Go, Rust, apps)
- CVE scanning via OSV.dev API (no auth, unlimited rate limits)
- Claude integration (CLI or SDK) for mitigation analysis
- JSON + HTML report generation
- Full test suite (34+ tests, 7 benchmarks)
- Production-grade linting (11 linters via golangci-lint)
- Vulnerability scanning (govulncheck)
- GitHub Actions CI/CD pipeline

## Key Components

- cmd/audit/: CLI entry point
- internal/inventory/: System inventory parsing
- internal/security/: OSV.dev querying, Claude integration, audit logic
- internal/report/: JSON and HTML report generation
- scripts/collect-inventory.sh: Bash script for system enumeration

## MVP Features

- Homebrew package scanning
- Python/Node/Go/Rust ecosystem scanning
- CVSS-based severity filtering
- Claude-powered recommendations (update/replace/protect/monitor)
- Makefile automation (test, lint, vulnerability checks)
- Pre-commit hooks configuration

## Testing & Quality

- 34+ unit tests with table-driven patterns
- 7 benchmark tests for performance
- 11 configured linters (staticcheck, gosec, revive, etc.)
- Code coverage reporting
- GitHub Actions CI (tests on Go 1.22 & 1.23)
- Pre-commit hook framework

## Documentation

- README.md: Full feature and usage documentation
- QUICKSTART.md: 3-minute setup guide
- TESTING.md: Testing and code quality guide
- QA_SETUP.md: Analysis tooling reference
- DATA_SOURCES_SPEC.md: Vulnerability data source documentation

## Data Sources

- OSV.dev: Primary CVE database (1.8 day latency, no auth needed)
- GitHub Advisories: Supplement for maintainer-created advisories
- OpenSSF Scorecard: Trust signals (repo health/practices)
- Homebrew Formulae API: Package metadata
- CISA KEV: Active exploitation tracking

## Next Steps

Phase 1 (MVP): Complete and tested ✓
Phase 2 (planned): Third-party app scanning, VirusTotal integration
Phase 3 (planned): Historical monitoring, scheduled audits, webhooks

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

internal/security/audit.go

@@ -0,0 +1,93 @@
+package security
+
+import (
+	"fmt"
+
+	"github.com/user/package-review/internal/inventory"
+)
+
+// Finding represents a security finding (CVE)
+type Finding struct {
+	PackageName string  `json:"package_name"`
+	PackageVersion string `json:"package_version"`
+	CVE         string  `json:"cve_id"`
+	CVSS        float64 `json:"cvss_score"`
+	Summary     string  `json:"summary"`
+	Link        string  `json:"link"`
+	Severity    string  `json:"severity"` // LOW, MEDIUM, HIGH, CRITICAL
+}
+
+// Mitigation represents Claude's recommended mitigation
+type Mitigation struct {
+	Finding         Finding `json:"finding"`
+	Recommendation  string  `json:"recommendation"` // update, replace, protect
+	Rationale       string  `json:"rationale"`
+	NextSteps       string  `json:"next_steps"`
+}
+
+// Audit represents the full security audit
+type Audit struct {
+	Inventory    *inventory.Inventory
+	Findings     []Finding `json:"findings"`
+	Mitigations  []Mitigation `json:"mitigations"`
+}
+
+// NewAudit creates a new audit for an inventory
+func NewAudit(inv *inventory.Inventory) *Audit {
+	return &Audit{
+		Inventory:   inv,
+		Findings:    []Finding{},
+		Mitigations: []Mitigation{},
+	}
+}
+
+// ScanOSV scans all packages against OSV.dev
+func (a *Audit) ScanOSV() error {
+	fmt.Println("  Querying OSV.dev...")
+	for _, pkg := range a.Inventory.AllPackages() {
+		findings, err := queryOSV(pkg)
+		if err != nil {
+			// Log but continue
+			fmt.Printf("  ⚠️  Error scanning %s: %v\n", pkg.Name, err)
+			continue
+		}
+		a.Findings = append(a.Findings, findings...)
+	}
+	return nil
+}
+
+// FilterByMinSeverity returns findings above a CVSS threshold
+func (a *Audit) FilterByMinSeverity(minCVSS float64) []Finding {
+	var filtered []Finding
+	for _, f := range a.Findings {
+		if f.CVSS >= minCVSS {
+			filtered = append(filtered, f)
+		}
+	}
+	return filtered
+}
+
+// CountVulnerable returns count of packages with CVEs
+func (a *Audit) CountVulnerable() int {
+	seen := make(map[string]bool)
+	for _, f := range a.Findings {
+		seen[f.PackageName] = true
+	}
+	return len(seen)
+}
+
+// AnalyzeWithClaude sends high-severity findings to Claude for analysis
+func (a *Audit) AnalyzeWithClaude(mode string) error {
+	highSev := a.FilterByMinSeverity(7.0)
+	if len(highSev) == 0 {
+		return nil
+	}
+
+	fmt.Printf("  Sending %d findings to Claude...\n", len(highSev))
+
+	if mode == "sdk" {
+		return analyzeWithSDK(a, highSev)
+	}
+	// Default: CLI mode via `claude` command
+	return analyzeWithCLI(a, highSev)
+}