security-review

To find high-confidence security vulnerabilities in a pull request, analyze code diffs and repository context to assess injection, authentication, cryptography, and data exposure risks. This process filters false positives through confidence thresholding, producing a prioritized markdown report with file locations, severity, and remediation steps.

Pre-merge security review reduces false positives from SAST assessments by applying parallel sub-tasks and confidence thresholding to filter findings. It focuses on exploitable issues with strong evidence, ensuring reviewers only receive actionable vulnerability reports instead of noisy alerts.

The best way to audit a feature branch for code execution and data exposure risks is performing multi-phase analysis that researches repository context and conducts comparative per-file vulnerability assessments. This identifies targeted input validation and crypto issues while generating actionable remediation guidance.

This security review approach works without external dependencies, analyzing repository context and code changes directly. It applies targeted coverage to identify vulnerabilities across auth, crypto, secrets, and injection vectors, delivering a prioritized markdown report independently of traditional SAST tools.

An actionable pre-merge vulnerability assessment report should include file locations, severity ratings, exploit scenarios, remediation recommendations, and confidence scoring. By prioritizing these elements, reviewers can quickly address high-confidence security issues introduced by code changes.

Manual SAST-style assessment for branch security audits should not be used when you need to scan entire codebases rather than specific code changes. This approach relies on analyzing diffs and repository context to identify high-confidence vulnerabilities, making it unsuitable for comprehensive baseline scanning.