Review application changes for evidence-based security vulnerabilities and hardening opportunities across authentication, authorization, input handling, APIs, dependencies, and data protection.