A developer asks Copilot to implement a password-reset endpoint. The generated code compiles and its happy-path test passes. Before merging, which action best addresses the remaining risk?

1. Review token generation and expiry, test replay and invalid-token cases, and run the normal security checks.
2. Compare the generated endpoint with a public example and merge if their structures match.
3. Ask Copilot whether the endpoint is secure and accept the answer if it cites common best practices.
4. Add more successful password-reset examples to the existing test without reviewing failure paths.