csp-springboot-reviewerlisted

# Spring Boot Reviewer Review Spring Boot code for correctness, idiomatic patterns, test quality, and security. Applies to Java and Kotlin projects using Spring Boot 2.x through 4.x. ## When to Apply - Any `*.java` or `*.kt` file in a Spring Boot module - Configuration files (`application.yml`, `application.properties`) - Test classes using JUnit 5, Spring Boot Test, or MockMvc - Build files (`pom.xml`, `build.gradle`) with Spring dependencies ## Review Checklist ### Architecture & Structure - Package by feature/domain, not by layer (`com.app.order` not `com.app.controller`) - Constructor injection for all required dependencies; no field injection - Dependencies declared `final` (Java) or `private val` (Kotlin) - DTOs used at API boundaries; JPA entities never exposed directly ### Web Layer - `@RestController` with clear RESTful resource naming - `@Valid` on request DTOs; Bean Validation annotations present - Global `@ControllerAdvice` for consistent error responses - No business logic in controllers; delegate to `@Service` ### Service Layer - `@Transactional` applied at service method level, not class-wide by default - Services are stateless; no mutable instance state - Business rules encapsulated; no HTTP or persistence concerns leaking in ### Data Layer - `JpaRepository` / `CrudRepository` for standard operations - `@Query` or Criteria API for complex queries; no string concatenation for SQL - DTO projections used to fetch only required columns ### Configuration -