Performs maximum-depth defensive security reviews using subagent planning, multi-phase investigation, and independent adversarial validation to minimize false positives. Use when findings drive shipping, compliance, or disclosure decisions and false positives must be rare — materially more expensive than code-review.
Performs full defensive security reviews of software repositories for vulnerabilities, authorization flaws, insecure data flows, and missing security tests. Use when reviewing a repo, application, service, codebase, PR, diff, or implementation plan.
Reviews PR or branch diffs, threat models the changed behavior, and reports net-new security vulnerabilities, correctness bugs, and operability regressions. Use for detailed security and correctness reviews of PRs, branches, patches, or diffs before merge.
Performs deep defensive reviews of authorization, access control, role boundaries, and tenant isolation. Use when testing for IDOR, BOLA, BFLA, privilege escalation, cross-tenant data access, or broken access-control regressions.
Reviews LLM and AI agent systems for prompt injection, unsafe tool use, context leakage, approval bypasses, and missing security tests. Use when auditing AI agents, MCP servers, tool routers, retrieval systems, or autonomous workflows.
Builds safe, authorized API abuse testing plans for applications. Use when testing APIs for broken access control, data exposure, unsafe input handling, replay, rate-limit gaps, or business logic abuse.
Orchestrates parallel security and code-quality audits for a branch or PR, deduplicates findings, and produces one prioritized merge-readiness list. Use when reviewing BASE...HEAD before merge.
Audits a branch or PR diff for maintainability, complexity, testability, and architecture regressions. Use when reviewing BASE...HEAD or PR diffs for code health issues before merge.