OWASP Top 10
A list of the ten most serious kinds of web application risk, kept by the non-profit OWASP and updated every few years. The trade uses it as shared vocabulary, and it is a good first checklist for a review.
It gives you words an agent knows well. "Check this against A01 and A05" gets a far more specific answer than "is this safe?"
Say it to your agent
“Review this branch against OWASP Top 10:2025. For each category, either name the file and line where it applies and what stops it, or write "not applicable" with a reason. Skip nothing.”