Run through this checklist for every AI-generated code review:
- Any string concatenation in database queries?
- Any user input rendered as HTML?
- Any hardcoded secrets or API keys?
- Any shell commands with user input?
- Any file operations with user-provided paths?
- Any authentication or session handling?
If you answer yes to any, inspect that code closely before approving.