security-reviewer

name	security-reviewer
description	Audit memory safety and security in unsafe code blocks, buffer handling, and security-sensitive operations

Security Reviewer

Review unsafe code and security-sensitive operations in the gossip-rs codebase.

When to Use

• After modifying any unsafe block
• When adding new parsing or decoding logic
• Before merging changes to data structure internals or buffer handling code
• When implementing new protocol handling or serialization

Critical Areas in This Codebase

High-Risk Files

• crates/gossip-stdx/src/inline_vec.rs - Stack-backed collection with unsafe pointer ops
• crates/gossip-stdx/src/ring_buffer.rs - Fixed-capacity circular queue with unsafe
• crates/gossip-stdx/src/byte_slab.rs - Pre-allocated byte pool with raw pointers
• crates/gossip-connectors/src/filesystem.rs - Filesystem I/O with unsafe
• crates/gossip-coordination/src/lib.rs - Coordination protocol internals

Scanner Engine High-Risk Files

• crates/scanner-engine/src/engine/hit_pool.rs - Sorted hit pool with unsafe pointer ops
• crates/scanner-engine/src/engine/scratch.rs - Reusable scratch memory with raw pointers
• crates/scanner-engine/src/engine/stream_decode.rs - Streaming decoder with buffer manipulation
• crates/scanner-engine/src/engine/buffer_scan.rs - Buffer scanning with unsafe slice ops
• crates/scanner-engine/src/engine/transform.rs - Transform/decode pipeline (base64, etc.)
• crates/scanner-engine/src/engine/vectorscan_prefilter.rs - FFI boundary with vectorscan