Add security checklist for AI and file upload features

[godekina]

Add security checklist for AI and file upload features

Repository: PolymorphicAI/study-copilot

Suggested Labels: documentation, security, ai, pdf, medium, wave-ready

Suggested Complexity: Medium / 150 points

---

Summary

Create a security checklist for AI generation, notes input, and PDF upload features.

Why This Matters

AI and file upload features need careful handling to avoid unsafe behavior.

Tasks

• Create docs/security-checklist.md.
• Cover API keys, uploaded files, prompt injection, output sanitization, and error messages.
• Add pre-PR checklist.

Acceptance Criteria

• Security checklist exists.
• AI and PDF risks are covered.
• Checklist is actionable.

Suggested Complexity

Medium / 150 points

Suggested Labels

documentation, security, ai, pdf, medium, wave-ready