security-reviewlisted

# Security review Scoped, standards-based review of a change to catch security defects before merge or deploy. ## When to use When a change touches authentication, authorization, secrets, input handling, injection surfaces, sensitive-data flows, outbound network calls, or dependencies — or whenever the workflow reaches a security step or a `policy.md` security gate. ## Method Scope to the diff and its trust boundaries (new inputs, new auth/authz checks, new secrets, new outbound calls, new dependencies). Walk each area, mapping findings to OWASP Top 10 (2021) and ASVS 5.0: 1. **Authentication & session** (Top-10 A07; ASVS Authentication) — credential handling, MFA where required, session lifetime/rotation/invalidation, no auth bypass introduced. 2. **Authorization / access control** (A01) — every new endpoint/action enforces least privilege and object-level checks; no IDOR, no missing server-side authz, no privilege escalation. 3. **Secrets & cryptography** (A02) — no secrets in cleartext, source, logs, or fixtures; `.gitignore` covers them and a `*.example` is provided; strong algorithms, no hard-coded keys, TLS in transit. 4. **Input validation & injection** (A03) — untrusted input is validated/encoded/parameterised; check SQL/NoSQL/command/LDAP injection and XSS on every new sink; no string-built queries. 5. **Sensitive-data exposure & misconfiguration** (A02, A05) — PII minimised and protected, safe error messages, secure defaults, no debug/verbose leak