## Security Review: [File/Feature Name]

### 🔴 Critical Issues
- **[Issue Name]** at [file.ts#L42](file.ts#L42)
  - **Risk:** Description of what could go wrong
  - **Fix:** Recommended remediation

### 🟠 High Issues
- **[Issue Name]** at [file.ts#L15](file.ts#L15)
  - **Risk:** Description of vulnerability
  - **Fix:** Recommended remediation

### 🟡 Medium Issues
- **[Issue Name]** at [file.ts#L88](file.ts#L88)
  - **Risk:** Description of concern
  - **Fix:** Recommended remediation

### 🟢 Low Issues / Recommendations
- Consider [improvement suggestion]

### ✅ Passed Checks
- Mass assignment protection ✓
- Input validation ✓
- Authentication checks ✓

// ✅ Correct: Whitelist fields explicitly
const { title, description, priorityId } = req.body
await prisma.task.create({
  data: { title, description, priorityId }
})

// ❌ Wrong: Mass assignment vulnerability
await prisma.task.create({ data: req.body })

<!-- ✅ Correct: Text interpolation (auto-escaped) -->
<p>{{ userInput }}</p>

<!-- ❌ Wrong: XSS vulnerability -->
<p v-html="userInput"></p>

// ✅ Correct: Validate before use
if (!title || typeof title !== 'string' || title.length > 200) {
  return res.status(400).json({ error: 'Invalid title' })
}

// ❌ Wrong: Trust user input
await prisma.task.create({ data: { title: req.body.title } })

// ⚠️ AI suggested this package - VERIFY before installing:
// 1. Check npm: https://www.npmjs.com/package/fast-csv-parser
// 2. Verify downloads (>10k weekly), maintainer, last update
// 3. Check for known vulnerabilities: npm audit
import { parse } from 'fast-csv-parser'

// ⚠️ AI generated complex logic - REVIEW carefully:
// - Does this match requirements?
// - Are edge cases handled?
// - Is error handling complete?

// ✅ Correct: Use environment variable expansion
{
  "env": {
    "API_TOKEN": "${env:GITHUB_TOKEN}"
  }
}

// ❌ Wrong: Hardcoded credentials
{
  "env": {
    "API_TOKEN": "ghp_xxxxxxxxxxxx"
  }
}