Security Review Checklist

- Every endpoint enforces authorization (not just authentication) - Deny by default — access requires explicit grant - CORS allowlists are specific, not `Access-Control-Allow-Origin: *` - Record ownership validated server-side (no IDOR via parameter tampering) - Admin functions isolated from user-facing routes - **Test**: Change user ID in request — should get 403, not another user's data