security-review

Invocation points:

• Any change touching authentication, authorization, session handling
• Any change touching user input → database, filesystem, or shell
• Any change exposing a new external surface (HTTP endpoint, webhook, IPC boundary)
• Secrets handling, environment variable changes, crypto code
• Pre-release audit of a feature or milestone
• Response to a suspected vulnerability

Do NOT use for:

• General code review (use review)
• Performance audits (use code-optimizer)