Apply security-first practices when building or reviewing code — input validation, secrets management, auth checks, OWASP Top 10 coverage. Triggered by "security review", "harden this", "is this secure", "security-hardening", "check for vulnerabilities", "audit my code", "run a security check", "is there anything unsafe here", "check for SQL injection", "check for XSS", "are there any security issues".
