security-review

Run a structured vulnerability pass over code — injection, auth/authz gaps, secrets exposure, unsafe deserialization, unvalidated boundary input, SSRF, and stack-specific classes — reporting findings by severity with concrete fixes. Trigger this after writing or modifying code that handles user input, authentication/authorization, database queries, file paths, external requests, deserialization, or secrets; before committing security-sensitive changes; and whenever the user asks for a security review or mentions handling untrusted data. Do NOT trigger for pure-internal logic with no trust boundary, or as a substitute for general code-review — this pass hunts vulnerabilities specifically.