security-pr-reviewer

Reviewing a pull request diff for security vulnerabilities requires analyzing the actual code changes for authorization gaps, injection flaws, and control regressions. This skill inspects branch deltas or staged changes to provide severity-ranked findings with file and line evidence.

Object-level authorization checking prevents IDOR by verifying server-derived tenant scoping on data access paths. It ensures users cannot access other tenants' objects by manipulating identifiers, validating that authorization checks are enforced on the server side before returning data.

Checking a code diff for injection flaws involves scanning changed files for SQL, NoSQL, shell, template, deserialization, and SSRF vulnerabilities. The review also identifies exposed secrets and verifies secure handling of external calls and upload logic.

Yes, this security review tool analyzes actual code diffs from pull requests, branch deltas, staged changes, or commits. It requires the real diff and base ref rather than a verbal description to accurately inspect changed files and return a verdict with evidence.

You need a dedicated security review when a pull request adds a new endpoint, relaxes a security control, or touches authentication, uploads, external calls, or data access logic. These changes introduce risks that a general code review might miss.

Exploit-path-backed severity ranking evaluates vulnerabilities by mapping the actual exploitation path for high-severity issues. It anchors findings to file and line numbers, providing remediation guidance and an approve or request-changes decision based on demonstrated risk.