security-checklist

name	security-checklist
description	Reviews code for security concerns, auth risks, and missing tests. Use when auditing a PR or investigating a bug fix.

When reviewing code:

1. Check auth and permission boundaries.
2. Look for insecure defaults.
3. Call out missing tests for failure paths.
4. Flag untrusted input that reaches shell, SQL, or templates.