pr-security-review

name	pr-security-review
description	When reviewing PRs that bump a dependency (including a GitHub Action), actively search for known vulnerabilities rather than reasoning abstractly

When reviewing a dependency bump PR, follow the "Reviewing dependency bumps" checklist in CONTRIBUTING.md, which is the source of truth for the steps.

Verify security by actually checking external sources — don't just reason about it in the abstract.