security

Audit the app's runtime security posture: the Content-Security-Policy and security headers in next.config.js, rate-limiting coverage on every public API route, and dependency CVEs. Use whenever the user mentions security, CSP, headers, XSS/clickjacking, unsafe-inline, rate limiting, abuse protection, npm audit, vulnerable dependencies, or "is this route protected" — even if they never say the word "security".