security-reviewlisted

# Security Review Threat-oriented review, language-agnostic, and the security entry point for the suite. The question is not "is this code good?" but "what can an untrusted actor make this code do?" For general correctness and maintainability, use `code-review`. Run both before shipping something that matters; they find different defects. ## Procedure Follow `../../references/procedure.md` for scoping, probing and error handling. Specifically: 1. **Establish the trust boundary first.** Before reading for defects, identify what is attacker-controlled: request parameters, headers, cookies, uploads, webhook payloads, queue messages, filenames, environment on shared hosts, and any data that made a round trip through storage. Everything downstream of an untrusted input is in scope; everything else is context. 2. **Scope.** The diff for a change review, the tree for an audit. State which you used — a clean result on three files is not a clean result on the application. 3. **Probe and run** the tools below. 4. **Delegate** to every language skill that applies — `review-go`, `review-bash`, `review-vue-ts`, `review-php` — asking each to weight its security-relevant rows (see Delegation). 5. **Walk the threat checklist below** over every file in scope. 6. **Score by exploitability** per `../../references/rubric.md` and the calibration note below, then merge. 7. **Emit both artifacts.** ## Capability probe ```bash command -v semgrep command -v gitleaks command -