app-security-reviewlisted

# Application Security Review Find credible attack paths in the current project and recommend concrete fixes at the boundary where trust should be enforced. Emphasize web application security across frontend and backend code while adapting the method to APIs, CLIs, workers, libraries, or other application surfaces. This skill has no required language, framework, deployment environment, browser, running server, scanner, or connector. Use the source, designs, configuration, contracts, and tools available for the requested review. ## Scope and routing - Honor the requested repository, feature, diff, or surface. For a diff, inspect surrounding callers and controls to establish behavior without turning the review into an unrelated repository-wide audit. - Cover technical exploits, exposed capabilities, unsafe defaults, and security-relevant business logic. A public API is not inherently unprotected; establish which actions and data should require authorization. - Content-driven phishing, scams, harassment, and moderation policy belong to `trust-and-safety-review` when available. Neither skill requires the other to be installed. Explain overlapping issues once and flag adjacent concerns without silently expanding the review. - Default to inspection and findings. Fix code only when the user's request authorizes fixes. Use existing permission for bounded local verification; a review alone does not authorize probing live services, accessing other users' data, load test