security-review

To check a pull request diff for security regressions, audit pending code changes with a threat-model-first lens to identify modified trust boundaries, auth paths, and parsers. This process distinguishes true exploit paths from defense-in-depth improvements.

Threat modeling for code changes involves forcing a targeted audit of the diff to enumerate suspicious constructs, validate them with surrounding code, and cross-reference known framework anti-patterns. This prevents shipping changes that introduce new vulnerabilities.

Yes, PR security scanning separates vulnerabilities from hardening opportunities by producing a structured output. This distinguishes true exploit paths involving injection, deserialization, or auth bypass from general defense-in-depth improvements.

To review dependency sets for supply chain risks, audit pending changes that modify dependency sets and cross-reference known framework anti-patterns. Read dependency advisories when applicable to ensure pipeline changes remain safe.

Yes, you can use automated security review for API endpoints modifying serializers and parsers by applying scope-aware checks. This calls out injection classes, resource exhaustion, and insecure defaults while validating authentication still holds.

Diff-focused security scanning is not sufficient when you need a full application audit, as it specifically prioritizes changes that touch trust boundaries, auth paths, secrets, and parsers rather than evaluating the entire codebase.