differential-review

To automate a security review of a pull request diff, provide the PR range to trigger phase-based code analysis, tracing inputs and outputs to identify vulnerabilities and generate a structured markdown audit report.

Differential code review for security risks is the process of analyzing code changes rather than the entire codebase to identify vulnerabilities in authentication, data handling, and external calls before deployment.

Yes, you can use this security audit in a CI workflow before merge; it applies phase 0 triage, blast radius estimation, and test coverage checks to code changes touching sensitive logic.

Blast radius estimation in a differential security audit works by tracing trust boundaries and vulnerability patterns in the diff to score the potential impact of code changes on sensitive logic.

The best way to assess test coverage for security vulnerabilities in a PR is to run a phase 4 test coverage assessment that evaluates whether existing tests adequately protect trust boundaries touched by the diff.

A risk-based approach for code review targets only the changed code, performing git history analysis and risk tiering to efficiently identify security risks without scanning the entire codebase.