Perform a defensive security review of a code change or pull request — systematically check for injection, broken access control, secrets, unsafe deserialization, SSRF, XSS, insecure crypto, and other common vulnerability classes — use before merging security-sensitive code, when reviewing a PR, or when hardening an existing module.
