# ApiVault Addon Audit Mode

ApiVault v0.6.0 adds a paste-based Addon Audit Mode.

## Purpose

The panel helps developers scan pasted Lua, XML or TOC text against ApiVault's generated metadata and safety rules.

## Safety policy

- No runtime file reads.
- No code execution.
- No automatic code rewriting.
- No protected or secure execution.
- No full Blizzard source display.
- Findings are checklist/audit notes, not proof of correctness.

## Commands

```text
/av audit
/av scan
/av addoncheck
```

## What is checked

- C_* API references against the documented API index.
- Event registrations against the documented event index.
- XML/template references against the XML Template Catalog where available.
- TOC metadata: Interface, dependencies, SavedVariables and secure flags.
- Secure-sensitive patterns such as SetAttribute and secure templates.
- Performance-sensitive patterns such as OnUpdate and C_Timer.NewTicker.
- Dynamic execution patterns such as loadstring and RunScript.

## Limitations

WoW addons cannot read arbitrary local source files at runtime. This tool audits text pasted into the panel. For full archive audits, use the external build/audit workflow with uploaded addon archives.
