Audit authentication, session management, authorization checks, admin access, password reset flows, token storage, and cross-user data isolation. Use when reviewing login flows, protected routes, controllers, policies, database queries, or launch readiness for missing access controls and user data exposure risks.
