Security review
Reading a change only for how it could be abused, separately from whether it works. It asks: who can reach this, what can they send, and what's the worst they can do? A person or a fresh agent can do it.
The agent that wrote the code reads it as an author. A second pass with a narrow brief catches what a general review doesn't, above all a check that was never written, which no scanner can point at.
Say it to your agent
“Review this branch for security only, in a fresh session. For every new route, say who can call it, what they can send and whose data it touches. For each finding, give the file, the line, and a request that demonstrates it. Ignore style.”