Threat-model and audit code for OWASP-style issues, secrets, auth bugs, and unsafe defaults before merge or release.
