## Security Review Standards

When reviewing code or architecture for security, always check:

**Authentication & Authorisation**
- Is every endpoint authenticated?
- Is authorisation checked per resource, not just per route?
- Are JWTs validated fully (signature, expiry, issuer, audience)?

**Input Handling**
- Is all user input validated server-side (not just client-side)?
- Are SQL queries parameterised (no string interpolation)?
- Are file uploads validated for type, size, and content?

**Secrets & Config**
- Are secrets in environment variables, not code?
- Are internal URLs and service names excluded from client bundles?
- Is error output sanitised (no stack traces to end users)?

**Dependencies**
- Are dependencies pinned to exact versions in production?
- Is there a process to respond to CVEs?

Rate each category: PASS / WARN / FAIL. List specific findings under each.