| name | security-review |
| description | Run a multi-pass security review over the current diff using parallel specialist subagents focused on injection, authn/authz, secrets, supply-chain, and infrastructure-as-code risks. |
Security Review
Use this workflow before merging or releasing change sets that touch authentication, data handling, network surface, infrastructure-as-code, or third-party dependencies.
Workflow
- Establish the diff scope:
git diff origin/main...HEAD --stat and a list of changed files.
- Spawn the
security-auditor subagent in parallel for each concern below. Each subagent reads only the diff plus immediately relevant context.
- Injection: SQL/NoSQL, command, template, deserialization, prompt injection in LLM-touching code.
- Authn/Authz: token handling, session, RBAC checks, privilege escalation.
- Secrets: hard-coded credentials, leaked keys, insufficient redaction in logs.
- Supply chain: new or updated dependencies, lockfile integrity, pinned versions.
- Infrastructure-as-code: open security groups, public buckets, missing encryption, weak defaults.
- Business logic: state-machine bypasses, atomicity violations, replay/race conditions.
- Each subagent returns findings ranked by severity with file/line citations.
- Verify each candidate finding against actual code behavior to filter false positives.
- Combine and dedupe results into a single severity-ordered list.
Constraints
- Do not exfiltrate secrets discovered during review; redact in the report.
- Treat "best practice" suggestions as low priority unless they map to a concrete risk.
- Cite OWASP Top 10 / CWE IDs where they sharpen the finding.
Final Report
Lead with verdict: Ready to Merge / Needs Attention / Needs Work. Then list findings by severity (Critical / High / Medium / Low / Info) with file, line, what fails, why it matters, and a concrete fix direction. End with verification reviewed and remaining gaps.
