{"agent":"claude","input":"Review the open pull request for security problems only. Check out its branch and read the diff. Trace every new request parameter, Livewire property and route parameter to where it reaches Eloquent, the filesystem or a shell. Compare each new route and Livewire action with its neighbours: in this app, forum writes authorize through ThreadPolicy, admin writes pass VerifyAdmins and UserPolicy, and BanRequest::authorize returning true is not itself a check. Flag whereRaw, orderByRaw or selectRaw that interpolates request input; leave bound query-builder calls and the existing DB::raw aggregate in Thread.php alone. Look for secrets in the diff, including a committed .env and any VITE_ variable that would ship to the browser. Do not flag the placeholders already in phpunit.xml. Post findings as inline review comments with the exploit in one sentence each. Post nothing if there are none. Do not push commits.","resources":[{"url":"https://github.com/your-org/your-app/pull/42"}]}