agent-security-review

To check a pull request for leaked secrets, run a lightweight security review on the PR diffs to identify committed keys, tokens, PEM files, and insecure environment variable patterns. It outputs blocking or advisory findings with specific file references.

The best way to detect IDOR risks is to apply a security review against the approved tech spec authorization model and PR diffs. It highlights missing authorization checks and deviations from the spec before deployment.

Yes, you can review container manifests and dependencies for misconfigurations in a PR. The security review checks touched files across backend services and web frontends to call out risky dependency changes and unpinned base images.

To perform a security review on a pull request, you need to provide the PR diffs, touched files, the approved tech spec authorization model, and repository stack context to generate accurate blocking or advisory findings.

A lightweight PR security review does not replace advanced security scanning. It focuses on catching obvious vulnerabilities, misconfigurations, and authorization gaps that should be flagged before an advanced security review or deployment.

To format security review findings for a pull request comment, generate blocking or advisory findings with direct file references. These results can then be fed to the review orchestrator to populate PR comments and a review-report entry.