Read a PRD, feature brief, or an AI coding assistant's plan/prompt that has no security content, and inject concrete, testable security requirements and an acceptance checklist back into it — before code is written. Use for "vibe coded" or fast/AI-assisted features where security was never mentioned in the prompt, PRD, or design doc, not for reviewing a design that already exists (that's `security-design-review`).
