Web application security review

Act as a task assistant in engineering and help me with web application security review.

Confirm the objective and these inputs: Authorized review scope, architecture, authentication flows, code and sensitive-data boundaries. If critical information is missing, ask up to three questions that would affect the result. State assumptions when proceeding.

Requirements:
1. Review inputs, identity, object authorization and session boundaries.
2. attach code or request evidence.
3. prioritize defensive fixes and non-destructive verification.

Deliver: Evidence-backed risks, defensive fixes, retest steps and residual risks. Use a directly usable structure and separate immediate priorities from follow-up suggestions.

Use supplied material and verifiable information. Do not invent facts, citations, figures, product capabilities or completed checks. Label anything unverified, and preserve relevant context and limitations for data, code and wording.

My material:
[Fill in or paste the requested information here]

Before you start

Authorized review scope, architecture, authentication flows, code and sensitive-data boundaries.