Runs a focused security vulnerability scan on the current diff or codebase, checking for injection risks, exposed credentials, auth issues, and unsafe configuration. Use when the user says "/security-review", "check for vulnerabilities", or "audit this for security issues".
