Reviews an authentication or session management flow for common weaknesses including credential stuffing exposure, session fixation, insecure token storage, and missing MFA. Triggers on "review my auth flow", "is my login secure", "session management review", "check my OAuth implementation", "auth security audit".
