security-review

Review a code change or security-sensitive implementation by tracing changed trust, authority, exposure, and sensitive-data flows to find concrete reachable security failures. Use when a change materially touches authentication, authorization, sessions/tokens, tenant isolation, privileged operations, untrusted input to sensitive sinks, files/paths, network requests, webhooks, external integrations, secrets/keys, cryptography, sensitive data, public exposure, CORS/CSRF, abuse controls, security configuration, or security-relevant dependencies. Default to the smallest affected security graph; use broader threat-based review only for new applications, major security redesigns, incidents, or explicit audits. Do not run generic OWASP/ASVS/STRIDE checklists by ritual, block solely on scanner/CVE presence, invent custom security controls when trusted primitives already satisfy the property, or report vulnerabilities without a reachable path and evidence.