security-analysis

Reviews code or a change for exploitable vulnerabilities — injection, auth and access-control gaps, secret exposure, unsafe deserialization, SSRF, path traversal, and reports them with the concrete attack path. Use this whenever the user asks about security, vulnerabilities, hardening, or a security review, and also proactively when a change touches authentication, authorization, user input handling, file paths, subprocess calls, deserialization, or credentials. For general correctness review, use code-review.