Method and inputs: see references/security-input-corpus.md Reviewer prompt: references/security-review-prompt.md

Review Security

Overview

/review-security asks one question about each security control a work item claims: does it engage? Not "is it there", not "does it look right" — does it actually reject hostile input when you send some.

Nothing else in this repository does that to application code. Three instruments come close and each misses for its own reason:

Instrument	Method	Why it misses
`finalise` DoD security agent	grep checklist + probe mode	probe mode is gated on the deliverable being an accept/reject predicate; a configuration object and a URL composer are not
`qa-story` / `qa-task` NFR security	judgement from reading	one line — "Review for security issues"
`review-code`	correctness + cleanups	security is one bullet; no security lens