style-reviewlisted

# Style review Review changed code against `code-style`, `frontend-standards`, and `backend-standards`. This skill checks conformance to house rules. It is not a bug hunt: use `/code-review` for correctness. ## Scope the diff first Review only what changed. Untouched code is out of scope even when it violates a rule, unless the change makes the violation worse. ``` git diff --stat main...HEAD git diff main...HEAD ``` For uncommitted work, `git diff HEAD`. For a PR, `gh pr diff <number>`. Read the full body of every file with a substantive change. A hunk shows you three lines of context, which is not enough to tell a guard clause from a truncated branch, or to know whether a file crossed its line limit. ## What to check, in severity order ### Blocking Ship-stoppers. These get fixed before merge. 1. **Unparsed boundary input.** A request body, query param, route param, or webhook payload read without a Zod parse. 2. **Missing or late auth guard.** Auth checked after work has begun, or ownership verified in application code instead of the query filter. 3. **Raw document returned.** A database document, or a spread of one, in a response body. 4. **Request data spread into a Mongo filter or update.** `findOne(parsed.data)` or `$set: parsed.data`. 5. **Internals in an error response.** Stack trace, driver message, upstream provider text. 6. **Swallowed error.** A `catch` that returns success. 7. **Missing timeout on an outbound call.** ### Style violations House rules.