review-security

# Review security Run a **security-focused** review: HTTP security headers, CSP, bot protection (when implemented), CORS/CSRF, input validation, secret management, dependency vulnerabilities, and error information leakage. Your reply must be a **plan of suggested changes**: concise, actionable, and structured-not only prose. ## Invocation Text after the slash command is additional scope/focus - narrow the review accordingly. If none given, use the default scope described below. ## Best practices alignment - **Headers** - CSP with nonces or strict-dynamic where needed; X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy; HSTS in production where applicable (often platform + `hono/secure-headers` on API). - **Input validation** - All external input (API bodies, query params, path params) validated with Zod schemas from `@repo/dtos-common` and `@hono/zod-validator` where applicable; use `.strict()` on schemas when appropriate; reject unknown keys; sanitize for context (HTML, URL, etc.) where output. - **Secrets** - Never in repo or client bundle; only in `.dev.vars` or wrangler env; no logging or error messages that include secrets. - **Bot protection** - Turnstile (or equivalent) on sensitive endpoints **when implemented**; token verified server-side before any processing; no bypass for "trusted" clients without verification. - **CORS and CSRF** - CORS allowlist (no wildcard in production); preflight handled; state-changing `/api/*` requests prote...