GitHub Copilot Code Review

Every pull request in this repo — including the AI-drafted one that kicks off the live demo — gets an automatic first pass from Copilot Code Review before a human ever looks at it.

It reads the diff and leaves inline comments for things a linter usually misses:

• A third-party GitHub Action pinned to a tag instead of a commit SHA
• A workflow requesting broader permissions than the job needs
• A missing integrity/crossorigin attribute on a third-party script
• A form handler with no input validation

None of these are "vulnerabilities" a dependency scanner would catch — they're judgment calls about code quality and defensive coding. That's the point: Copilot Code Review is the reviewer that reads intent, not just signatures.