name	security-review
description	Review code for common security vulnerabilities. Use when the user asks for a security-focused review or when you spot potential security issues.

Security Review

Injection — SQL injection, command injection, XSS. Look for string concatenation in queries or commands.
Authentication/Authorization — Missing auth checks, hardcoded credentials, weak token handling.
Data exposure — Sensitive data in logs, error messages, or API responses.
Input validation — Missing or insufficient validation of user input.
Dependency risks — Known vulnerable dependencies, unpinned versions.

For each finding:

name	security-review
description	Review code for common security vulnerabilities. Use when the user asks for a security-focused review or when you spot potential security issues.

Injection — SQL injection, command injection, XSS. Look for string concatenation in queries or commands.
Authentication/Authorization — Missing auth checks, hardcoded credentials, weak token handling.
Data exposure — Sensitive data in logs, error messages, or API responses.
Input validation — Missing or insufficient validation of user input.
Dependency risks — Known vulnerable dependencies, unpinned versions.

For each finding:

security-review