security-scan

Identify security risks (auth, input validation, data exposure, XSS/CSRF). Use before merge and for auth/DB changes.