Review the diff for `{{branch}}` against these dimensions, most-severe first:

- **Correctness**: edge cases, off-by-one, null/undefined, async races.
- **Security**: injection, authz, secrets, unsafe input.
- **Scope**: every changed line traces to the stated goal — flag drive-by changes.
- **Tests**: new behavior covered? failing-then-passing?
- **Simplicity**: could a senior engineer call this overcomplicated?

For each finding give file:line, why it's wrong, and a concrete failing scenario.