Add security audit knowledge entries

ober

b0c1ad1de40fa29503725d713ae471141849aab7

diff --git a/data/features.sexp b/data/features.sexp
index fca03a3..85546c0 100644
--- a/data/features.sexp
+++ b/data/features.sexp
@@ -887,4 +887,22 @@
    ("use_case"
      .
      "Validating large Jerboa Scheme tools such as jerbuild.ss after edits.")
+   ("votes" . 0))
+ (("description"
+    .
+    "Add a Jerboa MCP tool that accepts multiple project roots or glob patterns, skips common generated/vendor/artifact directories, runs security_scan/import/resource/FFI checks per repo, and emits a grouped markdown handoff with findings, false-positive notes, and success criteria.")
+   ("estimated_token_reduction"
+     .
+     "~3000-6000 tokens per large workspace audit")
+   ("example_scenario"
+     .
+     "Audit /Users/user/mine/chez* and /Users/user/mine/jerboa* while excluding target, vendor, .venv, model artifacts, generated parser output, and bare git backup repos, then generate a fix plan for another agent.")
+   ("id" . "cross-repo-security-review") ("impact" . "high")
+   ("tags" "security" "multi-repo" "audit" "report")
+   ("title"
+     .
+     "Cross-repo security review with generated/vendor exclusions")
+   ("use_case"
+     .
+     "Reviewing a workspace containing many related Jerboa and Chez repositories without manually running inventory, rg exclusions, and per-repo MCP scans.")
    ("votes" . 0)))
diff --git a/data/security-rules.sexp b/data/security-rules.sexp
index af44752..f9e48de 100644
--- a/data/security-rules.sexp
+++ b/data/security-rules.sexp
@@ -884,4 +884,13 @@
      .
      "(audit-emit|policy-emit|log-event)[^)]*env-tag")
    ("scope" . "scheme")
+   ("severity" . "high"))
+ (("id" . "empty-secret-auth-bypass")
+   ("message"
+     .
+     "Authentication or signature verification compares a secret value to the empty string. Do not bypass verification just because a secret is empty; fail closed unless an explicit development-only flag disables verification.")
+   ("pattern"
+     .
+     "\\(string=\\?\\s+[^\\)]*secret[^\\)]*\\s+\"\"\\)")
+   ("scope" . "scheme")
    ("severity" . "high")))