cca-f-roadmap

Use when the user asks for a security review of a PR or branch — looks for hardcoded secrets, unsafe deserialization, SQL injection, missing auth checks, and CVE-tagged dependencies. Triggers on "security review", "audit this PR", "is this safe to merge", or when changes touch auth/billing/PII paths.