Review real software repositories for likely security issues using the local OWASP Top 10:2025 category set, official OWASP-mapped CWE lists, and canonical MITRE CWE records. Use when auditing source code, configuration, IaC, pipelines, dependencies, auth flows, crypto, logging, or error handling, and when the goal is evidence-based findings mapped to both CWE and OWASP 2025 with confidence levels and coverage gaps.