{"agent":"claude","input":"Review the open pull request for security problems only. First read the views, helpers and decorators that existing routes use to authorize access. Trace every new request parameter to where it reaches the database, the filesystem or a shell, check that each new route enforces the same authorization as its neighbours, and look for secrets in the diff. Run ./manage.py test for the touched apps, and for each authorization finding, confirm it with a throwaway test in the sandbox that calls the route as a user from another project. Post findings as inline review comments with the exploit in one sentence each and the status code you observed; post nothing if there are none. Do not push commits.","resources":[{"url":"https://github.com/your-org/your-django-app/pull/123"}]}