/code-review

# Code Review Report

## Files Changed
- src/auth.ts (modified)
- src/api/users.ts (modified)

## Issues Found

[CRITICAL] Hardcoded API Key
File: src/auth.ts:15
Issue: API key hardcoded in source
Suggestion: Move to environment variable

Before:
```typescript
const apiKey = "sk_live_abc123xyz";

const apiKey = process.env.API_KEY;
if (!apiKey) throw new Error("API_KEY required");

const user = await fetchUser(id);

try {
  const user = await fetchUser(id);
} catch (error) {
  logger.error("Failed to fetch user", { id, error });
  throw new Error("User fetch failed");
}

## Approval Criteria

| Status | Condition |
|--------|----------|
| ✅ Approve | No CRITICAL or HIGH issues |
| ⚠️ Warning | Only MEDIUM issues (merge with caution) |
| ❌ Block | CRITICAL or HIGH issues found |

## Important Notes

<Warning>
  Never approve code with security vulnerabilities! Always fix CRITICAL issues before committing.
</Warning>

## Integration with Other Commands

- Use after writing/modifying code
- Use before committing changes
- Combine with `/verify` for full checks

## Related

- **Agent**: `agents/code-reviewer.md`
- **Commands**: `/verify`, `/security`, `/go-review`, `/python-review`