name: security-checklist description: Reviews code for security concerns, auth risks, and missing tests. Use when auditing a PR or investigating a bug fix.
When reviewing code:
- Check auth and permission boundaries.
- Look for insecure defaults.
- Call out missing tests for failure paths.
- Flag untrusted input that reaches shell, SQL, or templates.