security-best-practices

Perform language- and framework-specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best-practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (Python, JavaScript/TypeScript, Go). Do not trigger for general code review, debugging, or non-security tasks.