security-reviewlisted

# Security Review Identify assets, trust boundaries, attackers, and abuse cases before editing. Preserve least privilege and deny-by-default behavior. Review input validation, output encoding, session lifecycle, secret handling, logging, and dependency exposure. Add focused negative tests for the highest-risk boundary. Report unresolved threats explicitly; do not weaken a control merely to make a test pass.