Budgeting a 200-File Security Audit

You need to run a one-time audit across roughly 200 files in a large repository, looking for a specific category of bug (unescaped user input reaching a template renderer). The output should be a single prioritized report of every genuine instance found, with a brief explanation of the risk for each. Design a subagent-based approach to this task, and produce a rough, reasoned cost estimate — not an exact dollar figure, but a structural explanation of where the spend actually goes and how your design controls it.

Cover: how you'd split the work across subagents, what model each stage should run on and why, how you'd control per-subagent context size, and which cost-playbook habits from this subject are load-bearing in your design.