review-securitylisted

# Review security ## When to use - A PR handles untrusted input (request bodies, query params, uploaded files, webhook payloads, LLM output that is then executed). - A change touches authentication, authorization, or session handling. - Code reads, writes, or logs a secret, token, or credential. - A change makes an outbound request to a URL derived from user input. This is a focused security pass, not a full audit. It looks at the four lenses below and reports what it finds. If the repo has a threat model (`docs/THREAT_MODEL.md`), read it first and check the change against the boundaries it states. ## Procedure Walk the diff through each lens. For every finding, record the file and line, the concrete risk, a severity (P0 exploitable now / P1 exploitable with effort / P2 hardening), and a specific fix. 1. **Injection.** Any place user input reaches an interpreter: SQL, shell, a template, an eval, or a prompt to an LLM whose output is then trusted. Look for string-concatenated queries, `shell=True`, and LLM output used as a command or path without validation. Fix: parameterize, allowlist, or escape at the boundary, never by sanitizing the input string. 2. **Authorization.** Does every mutating path check that the caller may act on THIS object, not merely that they are logged in? Look for missing object-level checks (IDOR): `GET /orgs/{id}/secrets` that never verifies the caller belongs to `{id}`. Fix: enforce the check server-side, close to the d