Review Security Compliance

Purpose

Review code and configuration changes for security and compliance risk with findings-first output. Focus on practical risk reduction, auditable evidence, and concise reporting.

Use this skill when a change may affect:

• authentication or authorization boundaries
• tenant isolation or sensitive data handling
• externally reachable APIs, webhooks, or integrations
• privileged operations, auditability, or operational resilience
• regulated workflows or evidence relevant to certification controls

When another project guide exists, follow it in addition to this skill. If no project-specific guidance exists, this skill is self-sufficient.

Reusable Review Scope