code-sec

Run gitleaks over the full git history and working tree with the --redact flag so discovered secrets are never printed. Findings are reported by file, rule ID, and commit, and secrets found in history are flagged for rotation and possible purge.

The sweep auto-detects the stack from marker files: npm audit for package.json, pip-audit or osv-scanner for Python, cargo audit for Cargo.toml, and govulncheck for go.mod. It reports the vulnerable package, advisory ID, and fixed version without auto-upgrading.

ast-grep with a tiered rule pack detects SQLi, command injection, SSRF, path traversal, and deserialization patterns in Python and JavaScript. Precise-tier hits are near-conclusive, while noisy-tier candidates require taint-tracing from entry point to sink before being filed.

No, the sweep is strictly read-only. It never fixes, rotates, or deletes anything during the audit; every finding becomes a tagged [SECURITY] item in TODOS.md, and remediation is handled as a separate task with user confirmation.

Without a trailing path, ripgrep reads from STDIN in non-interactive shells like agent Bash or CI and hangs until timeout. Always append an explicit path such as '.' to every rg command.

Use a full project sweep for broad audits of secrets, dependencies, and code patterns. For reviewing a specific diff or pull request, a focused security-reviewer skill is more appropriate, and plan-level review belongs to a security-lens reviewer.