Security Review

Review the diff for exploitable security failures. Report only findings with a concrete attack path, trust-boundary failure, or unsafe default — the Scope buckets below are where attack paths hide, not a checklist to sweep.

Scope

1. Trust boundaries and access control

• auth and trust boundaries
• authorization gaps between clients, sessions, and operations
• endpoint exposure and listener defaults

2. Transport and encryption

• transport security (HTTP vs HTTPS, WS vs WSS)
• sensitive payloads traversing insecure channels
• key/secret handling: env-based sourcing, redacted logs, no plaintext persistence

3. Execution boundaries