Made a pre-merge security pass skill for the team — it caught an IDOR in a teammate's PR the very first week I ran it

Trigger this skill when I ask for a security pass on a diff or PR, or automatically suggest it when a changeset touches: authentication or session code, route handlers with user-supplied parameters, file upload/download paths, raw SQL or query builders, serialization, or environment/secret handling. Do not run it on pure UI or docs changes. Review ONLY the changed code plus the functions it directly calls. This is a targeted pass, not a full audit — say so in the output header. Check in this order: 1. **Authorization on every new data access.** For each new or modified query/endpoint: is ownership or role checked via the central permissions module? Flag any inline ownership check or any handler that takes an ID from the request and fetches without a scope filter — that is the IDOR pattern. 2. **Input handling.** Every user-supplied value: is it validated (schema/type) before use? Look for string interpolation into queries, shell commands, file paths, or HTML. 3. **Secrets and logging.** New env vars documented? Any secret, token, or PII flowing into log statements or error responses? 4. **Failure behavior.** Do new error paths fail closed? A catch block that continues as if authorized is a finding. 5. **Dependencies.** New packages: check name spelling against typosquats and whether the capability already exists in-project. Output format: findings ordered by severity (Critical/High/Med/Low), each with file:line, the risk in one sentence, and a concrete fix. End with what you did NOT review, so nobody mistakes this pass for full coverage. Zero findings is a valid result — do not invent issues to seem useful.