security-review

Automate security reviews by spawning a read-only security-engineer agent that audits code changes for OWASP Top 10 vulnerabilities, credential exposures, and misconfigurations. This process runs after the Build phase and produces a verdict that gates the Final Gate.

A security review pipeline gate blocks code merges by issuing a verdict based on severity findings. The agent issues APPROVE if no CRITICAL, HIGH, or MEDIUM findings exist, otherwise it returns CHANGES_REQUESTED to block progression.

Run secrets detection and dependency scanning in tandem by applying the security review phase after the Build phase. The security-engineer agent evaluates findings in parallel with other reviews and re-invokes when changes are needed.

Yes, the security review agent supports authentication and authorization audits. It performs these checks alongside OWASP Top 10 audits, dependency scanning, and secrets detection to guard against security regressions.

Any CRITICAL, HIGH, or MEDIUM severity findings trigger a CHANGES_REQUESTED verdict. The security audit only issues an APPROVE verdict when no findings at these severity levels are detected.