name	pr-quick-check
description	Fast security pass over a pull request diff — scanners plus a targeted grep for risky patterns.
tags	["pr","review","quick","security"]

PR Quick Check

A fast, repeatable security pass over the changes under review. Use it when someone asks for a quick read on a pull request or a set of local changes before a deeper review. It favours signal over completeness: run the scanners, skim for the usual footguns, report what matters.

Steps

Frame the change. Use list_files and read_file to understand what the diff touches — which packages, which entry points, whether secrets, auth, or input handling are involved. Keep this lightweight; you are orienting, not auditing every line.
Run the static scanners.
- run_semgrep for code-level vulnerability patterns (injection, unsafe deserialization, weak crypto, path traversal, …).
- run_gitleaks for committed secrets — API keys, tokens, private keys.
Grep for risky patterns the scanners miss. Use grep to look for anything that warrants a human eye, for example:
- TODO|FIXME|HACK|XXX near security-relevant code
- eval|exec|os/exec|subprocess (command execution)
- password|secret|api[_-]?key|token in source (hardcoded credentials)
- http:// URLs (cleartext transport)
- disabled TLS verification (InsecureSkipVerify, verify=False)
Triage. For each finding, decide: is it introduced by this change, or pre-existing? Is it exploitable, or noise? Prefer reporting a handful of real issues over a long list of low-confidence hits.
Report. Summarise: a one-line verdict (safe to merge / needs changes / blocked), then the findings that drove it, each with file, line, severity, and a concrete fix. Note explicitly if a scanner could not run.

Notes

This is a quick check, not a full review. Call out where you stopped so the reader knows what was and was not covered.
Every tool here is sandboxed to the repository under review; you cannot reach outside it, and you should not try.

Más de este repositorio

mismo repositorio

authz-audit

argusappsec/argus

White-box detection of broken authorization (BOLA/IDOR, BFLA, access-control logic flaws) in an API or web codebase. Use when asked to audit authorization, hunt IDOR/BOLA, check object-level or function-level access control, or verify that handlers scope data access to the current principal/tenant. Reconstructs the app's ownership model first, then finds access paths that skip the per-object/per-role check their peers enforce. Static, read-only; delegates injection/secrets/path-traversal to run_semgrep/run_gitleaks.

2026-06-214

secret-rotation-plan

argusappsec/argus

Find committed secrets and draft a prioritised, step-by-step rotation plan saved to context.

2026-06-104

threat-modeling

argusappsec/argus

Build a STRIDE threat model of a codebase from its structure and code, using the bundled template.

2026-06-104

name	pr-quick-check
description	Fast security pass over a pull request diff — scanners plus a targeted grep for risky patterns.
tags	["pr","review","quick","security"]

PR Quick Check

Steps

Frame the change. Use list_files and read_file to understand what the diff touches — which packages, which entry points, whether secrets, auth, or input handling are involved. Keep this lightweight; you are orienting, not auditing every line.
Run the static scanners.
- run_semgrep for code-level vulnerability patterns (injection, unsafe deserialization, weak crypto, path traversal, …).
- run_gitleaks for committed secrets — API keys, tokens, private keys.
Grep for risky patterns the scanners miss. Use grep to look for anything that warrants a human eye, for example:
- TODO|FIXME|HACK|XXX near security-relevant code
- eval|exec|os/exec|subprocess (command execution)
- password|secret|api[_-]?key|token in source (hardcoded credentials)
- http:// URLs (cleartext transport)
- disabled TLS verification (InsecureSkipVerify, verify=False)
Triage. For each finding, decide: is it introduced by this change, or pre-existing? Is it exploitable, or noise? Prefer reporting a handful of real issues over a long list of low-confidence hits.
Report. Summarise: a one-line verdict (safe to merge / needs changes / blocked), then the findings that drove it, each with file, line, severity, and a concrete fix. Note explicitly if a scanner could not run.

Notes

This is a quick check, not a full review. Call out where you stopped so the reader knows what was and was not covered.
Every tool here is sandboxed to the repository under review; you cannot reach outside it, and you should not try.