Documentation
README
Security Review
Review the current change like a security-minded senior. Prefer concrete findings over generic advice.
Scope
Focus on the diff and directly related call paths. Do not audit the whole repo unless asked.
Checklist
Auth & access
- Every sensitive action checks authentication and authorization
- IDs from the client are not trusted for ownership (
userIdin body ≠ proof) - Admin/debug routes are gated; no "temporary" open endpoints
Input & data
This is the opening of the README. Read the full README on GitHub.