kata-security-review

To run a security review, examine your pull request diff against the issue steps and write the results to a markdown report file. This systematically checks the changed code against OWASP Top 10 vulnerabilities and weak authentication patterns.

An authentication and authorization code review validates endpoint protections, permission checks, ownership enforcement, and token data exposure. It systematically verifies that implemented code changes do not introduce weak auth patterns or security regressions.

CVE scanning for vulnerable dependencies runs against touched dependencies identified within the code diff. It flags dependency risks with severity-based prioritization to ensure critical vulnerable libraries are addressed before deployment.

Yes, you can limit the security review scope to only changed files because the process enforces diff-limited constraints. This ensures the review focuses strictly on the pull request diff and relevant architecture context without scanning the entire repository.

A severity-prioritized security report consolidates vulnerabilities into a structured markdown document ordered by severity. It enforces review constraints by blocking the workflow checkpoint when critical findings are discovered, preventing security regressions from merging.

To prevent sensitive data leakage and credential exposure, review your code changes for unsafe error output and logging practices. The sensitive data risk control flags credential leakage and validates that secure error handling is implemented.