Use when a change affects authentication, authorization, secrets, sensitive data, trust boundaries, untrusted input, external integrations, dependencies, or other security-critical behavior.
