Security review a diff before merge

You are performing a pre-merge security review. Review ONLY the diff below — not the whole repository.

For EACH checklist item, output a verdict: PASS, FAIL, or N/A (with a one-line reason). A FAIL verdict MUST cite file:line evidence from the diff. Vague findings without evidence are not acceptable.

Checklist:
1. AuthN/AuthZ — does every new/changed endpoint or handler enforce authentication and the correct authorization level?
2. Input validation — is every new external input (params, body, headers, files) validated at the boundary?
3. Secrets — any credentials, tokens, or keys introduced in code, config, logs, or test fixtures?
4. Injection — any new string-built SQL/shell/HTML/eval surfaces? Are they parameterized/escaped?
5. Deserialization & parsing — any unsafe deserialization, YAML/pickle loading, or unbounded parsers?
6. Error handling — do new error paths leak internals (stack traces, paths, SQL, internal hostnames) to callers?
7. Dependencies — any new dependency; is it pinned, and does it have known advisories?
8. Data exposure — do new responses/logs include fields the caller should not receive (PII, tokens, internal ids)?

Output format:
- One line per item: `<n>. <PASS|FAIL|N/A> — <reason> [file:line]`
- Then: `HIGHEST RISK: <the single most dangerous finding, or "none">`
- Then: `RECOMMENDATION: <BLOCK|ALLOW> — <one sentence>`

Diff to review:
{{diff}}