security-review

Security-focused review of an open-source pull request or diff. Use when the change touches authentication or authorization, cryptography, token or session handling, input parsing, deserialization, subprocess or shell invocation, file path construction, uploads and archive extraction, outbound HTTP built from user input (SSRF), permission and ACL logic, secrets and credential handling, or any code path where untrusted input reaches a sink. Also use when a reviewer explicitly asks for a security pass on a diff. Applies the suite's 10-point filter at a lowered floor of 7.5 and routes exploitable findings through private disclosure instead of a public comment. Language- and ecosystem-agnostic. Do NOT use for offensive security work, writing exploits or proof-of-concept payloads, penetration testing live infrastructure, or license and supply-chain auditing — that belongs to dependency-review.