code-review-securitylisted

# Code Review & Security ## Overview Perform thorough, opinionated pre-merge reviews and security audits. Apply a five-axis framework, classify findings by severity, and produce a consistent report so issues are actionable. ## When to Use - "review 代码", "代码审查", "审查这个 PR", "review this PR", "安全审计", "security audit", "code review". - Before merging a feature, bugfix, or refactor. - When the user wants a focused security pass. ## Five-Axis Framework 1. **Correctness** — Does it do what the spec says? Edge cases, off-by-one, null/empty, concurrency. 2. **Readability** — Can another engineer understand it without explanation? Naming, structure, comments. 3. **Architecture** — Follows existing patterns? Right abstraction level? No leaky boundaries. 4. **Security** — Input validation, authz checks, secrets, injection, XSS, rate limiting, IDOR. 5. **Performance** — N+1 queries, unbounded loops, missing pagination, needless allocations. ## Severity Classification - **Critical** — data loss, security vulnerability, broken functionality. Must fix before merge. - **Important** — missing test, wrong abstraction, poor error handling. Should fix before merge. - **Suggestion** — naming, style, optional optimization. Consider. ## Procedure 1. Read the diff / changed files fully; do not skim. 2. Run each axis against the change; note `file:line — description + recommended fix`. 3. Always note at least one thing done well. 4. Emit the report using `references/review-template.md`. 5. Includ