Security checklists for everyday diffs — parameterize at trust boundaries, allowlist enums, per-object authorization, secrets never in logs/bundles/errors. Apply while writing any code touching user input, authn/authz, secrets, paths, URLs, subprocesses, SQL, HTML rendering, or external APIs.
