Security Review

Perform a security review of the codebase or specified changes.

Process

1. Identify the scope — specific files, a PR diff, or the full codebase
2. Work through each category in @CHECKLIST.md
3. For each finding, record:
   • Severity — Critical / High / Medium / Low
   • Location — file:line reference
   • Issue — What's wrong
   • Fix — Specific remediation steps
4. Summarize findings grouped by severity

Rules

• Focus on real vulnerabilities, not theoretical risks
• Provide specific fixes, not just warnings
• Check for secrets in code, not just logic flaws
• Consider the deployment context when rating severity
• If no issues found, say so — don't manufacture findings

Gotchas

• Don't flag theoretical risks in dead code paths — verify the code is actually reachable