security-review

Ask for a focused security review of the PR, branch, or changed files. The review inspects trust-boundary code paths such as endpoints, auth handling, and webhooks, then reports findings ordered by severity with file and line evidence and concrete mitigations.

A threat model covers scope and assumptions, components and entry points, assets and trust boundaries, realistic attacker capabilities, top abuse paths with likelihood and impact, and recommended mitigations. It stays concise and grounded in repository evidence.

Yes, the references/focus-areas.md file provides targeted guidance for Odoo access control and sudo usage, Next.js auth boundaries and Prisma query authorization, plus Launchplane control planes, Docker builds, and PyPI publishing.

Do not use it for ordinary code review, debugging, readiness checks, or general implementation work. It is intended only for explicit security requests such as audits, threat models, secrets checks, or questions about whether code is safe.

Reports never expose secret values. Findings redact credentials and cite only safe key names, file paths, or configuration surfaces, and no report file is written to the repo unless explicitly requested.