Validation-first security-review framework — a capability showcase for defensive static analysis with OWASP mapping, exact file-and-line evidence, dependency CVE checks, and reproducible remediation steps. No speculative claims and no penetration testing. Source: https://github.com/koffietovenaar/agent-storefront