Reviews bot-written PRs and pre-ship apps for stale deps, fake packages, weak auth, and missing controls