API Code Review Patterns

Quick Guide: When a diff touches server code, trace every external input to where it is used - it must pass schema validation at the boundary and never reach a query or shell as a concatenated string. Verify every new route names its auth expectation and checks object-level access. Check what errors and logs expose. Security findings outrank everything else in the diff.

<critical_requirements>

CRITICAL: Before Reviewing API Code

All code must follow project conventions in CLAUDE.md (kebab-case, named exports, import ordering, import type, named constants)

(You MUST trace every external input in the diff - body, params, query, headers - to its use, verifying schema validation at the boundary)

(You MUST verify no user input is concatenated into SQL, shell commands, or file paths - parameterized queries and validated paths only)

(You MUST verify every route the diff adds declares its authentication requirement and checks authorization for the object it touches)

(You MUST check that secrets, tokens, passwords, and PII do not reach logs, error responses, or client payloads)