commit-security-scan

Scanning code changes for security vulnerabilities involves analyzing PRs, commits, and diffs using LLM-powered threat-model reasoning. The process applies your repository's threat model and security configuration to identify STRIDE-based vulnerabilities across changed files and reports findings in a structured format.

STRIDE-based threat modeling for code diffs is an analysis mechanism that identifies security vulnerabilities in changed files. It applies the repository's threat model and security configuration to evaluate code modifications during PR reviews, pre-commit scans, or branch comparisons.

Yes, the security scan requires a threat model at .factory/threat-model.md and a security config at .factory/security-config.json. If these prerequisite files are missing, the scan can auto-generate them to enable the vulnerability analysis workflow.

Yes, you can use LLM reasoning to detect vulnerabilities during pre-commit checks. The scan evaluates code diffs and applies severity thresholds from your security configuration to enforce secure development before commits are finalized.

The best way to compare branches for security threats is to run a diff scan that applies your repository's threat model to the changed files. This identifies STRIDE-based vulnerabilities across the branch differences and reports findings in a structured format.