What checklist catches risky API route leaks during quick reviews?