Use when the user wants a codebase security audit, security review, hardening check, "safe to ship" review, or to verify privacy/security/trust/legal/product claims against code. Also use for secrets, auth, admin routes, headers, cookies, CORS, CSRF, rate limits, dependency CVEs, encryption, 2FA/MFA, SSO, audit logs…