Security Review

Load the review method; use Research when dependency/advisory claims need current evidence. Reuse existing fix/testing authority; review alone adds no remediation or live-exploitation authority.

flowchart LR
  R[Code Review method] -->|Current dependency / advisory evidence| D[Research]
  click R "../code-review/references/review.md"
  click D "../research/SKILL.md"

• Trace = sensitive asset + caller/input + required permission → actual enforcing owner → operation/data. UI visibility or a caller's check does not prove server authorization.
• Coverage = focused change → affected path + adjacent callers; broad review → actual entry points + assets, then relevant surfaces below. Mark material missing evidence.