{"agent":"claude","input":"Review the open pull request for security problems only. First read the auth middleware and how existing services check ownership before updates and deletes. Trace every new request parameter to where it reaches the database, the filesystem or a shell, check that each new route enforces the same authentication and ownership checks as its neighbours, and look for secrets in the diff, including hard-coded fallbacks for signing keys. Run the test suite, then start the app against a fresh Postgres with the Prisma migrations applied and confirm each authorization finding by calling the route as a second user. Post findings as inline review comments with the exploit in one sentence each and the status code you observed; post nothing if there are none. Do not push commits.","resources":[{"url":"https://github.com/your-org/your-express-app/pull/123"}]}