security-review
Identify the vulnerability class, the exact untrusted input path, and the fix at the trust boundary. Prefer parameterized queries, framework escaping, and platform auth primitives over hand-rolled sanitizers. Confirm no other caller reaches the same sink.