security-reviewlisted

# Security Review ## Overview AI-generated code fails in specific, repeatable security ways: it hardcodes secrets, concatenates user input into queries and shells, forgets the authorization check its neighbors have, deserializes untrusted data, and imports dependencies that are vulnerable or do not exist — and generated code tends to be over-trusted, so these flaws ship. This review catches them before they do; it is the security surface exloom's other gates barely touch. It is deliberately **evidence-based, not vibes-based**: it runs the security tools that exist in the repo and pastes their real output, then reviews the diff against a fixed taxonomy. "No findings" is only allowed when the tools actually ran. ## Honest scope (say this to the user) This is a **first pass, not a guarantee.** It does not certify code "secure"; the strongest claim it makes is "no issues found by the checks that ran." Real assurance for a high-risk change needs SAST/DAST, a dependency-vulnerability service, and human security review or a pentest. Treat a clean result as "nothing obvious," not "safe." A green check that people over-trust is worse than no check. ## When to run it Run a security review when the change touches any of: **user-input handling, authentication/authorization, tenancy, secrets or credentials, PII or data exposure, deserialization/parsing, server-side outbound requests, cryptography, or dependencies (added or updated).** Within `exloom:review-gate` it is required on e