Secure Code Review

Review code for vulnerabilities systematically, not line-by-line.

1. Orient

• What does this code do? Identify: entry points, trust boundaries, data stores, privileged operations
• Read the tests — what invariants do they reveal?
• Check the diff's blast radius: auth logic? parsing? file handling? crypto?

2. Trace Untrusted Data

Follow each input from entry point to sink: