cc-reviewlisted

# Code Review Workflow Review target: $ARGUMENTS Specify what to review. Accepted formats: - A branch name: `feature/my-branch` - A file or set of files: `src/api/UserController.kt` - A pull request reference: `PR #42` - Empty — defaults to the current working diff (`git diff`) --- ## Step 1 — Diff collection Before invoking `reviewer`, collect the diff for the specified target. If $ARGUMENTS is empty or not provided: - Use `git diff HEAD` as the review target If $ARGUMENTS is a branch name: - Use `git diff main...$ARGUMENTS` (or `develop` if main is not the base) If $ARGUMENTS is a PR reference: - Retrieve the PR diff and the PR description for context If $ARGUMENTS is a file path: - Use `git diff HEAD -- $ARGUMENTS` Show the diff summary (files changed, lines added/removed) before invoking reviewer. --- ## Step 2 — Security and code review ### Security review (security-reviewer) Invoke `security-reviewer` **before** `reviewer` when the change touches: - Authentication or authorization logic - Payment or financial processing - Credentials, tokens, secrets, or API keys - SQL injection, XSS, or other injection vectors - Supply-chain dependencies (new packages, lockfile changes) - OWASP Top 10 categories `security-reviewer` performs deep security analysis and can apply a **security veto** that overrides majority consensus: - When `securityVeto: true` and verdict is `REJECTED`, the veto forces the final status to `REJECTED` regardless of other reviewers'