Use when asked to check, audit, or review a web application's security, authentication, permissions, access control, error handling, API/endpoint surface, or database management — including "is my app secure", "check my auth", "review my permissions", "find vulnerabilities", or a pre-launch/pre-handover review.
Use when building or editing a small database-backed web app in ANY stack — plain PHP, Laravel, or Supabase, on MySQL/MariaDB, PostgreSQL, SQLite, SQL Server, or a hosted DB — scaffolding a project, creating or evolving a database, designing tables or writing SQL, adding login/registration or user roles, building a…