Use when reviewing a pull request, patch, component, or repository for exploitable application-security defects, trust-boundary failures, unsafe privilege, secret exposure, or missing security verification.
