There's so much superstition and outdated information out there that "try it yourself" really is good advice.

You can do that in conjunction with trying things other people report, but you'll learn more quickly from your own experiments. It's not like prompting a coding agent is expensive or time consuming, for the most part.

/security-review really is pretty good.

But your codebase is unique. Slop in one codebase is very dangerous in another.