Query Review
Focus
- missing tenant scopes
- authorization after broad fetches
- raw SQL without parameter binding
- N+1 patterns that become availability or side-channel issues
- eager loads that overexpose sensitive associations
- cache keys missing tenant or role context
Heuristic
Treat data-access issues as security-relevant when they change scope, leak metadata, or undermine availability controls.