security-review-v4

Automate OWASP PR security reviews by analyzing code diffs and infrastructure context to identify risks. The review applies project standards to classify findings, suppress false positives, and post actionable remediation guidance as PR comments or approvals.

Infrastructure-aware security analysis reduces false positives by checking infrastructure files like Bicep, Dockerfiles, and GitHub Actions workflows during the PR review. It aligns findings with architecture references and CI/CD baseline rules to triage risks accurately.

Yes, you can review infrastructure changes and authentication flows in the same pull request. The security review evaluates both code and infrastructure diffs simultaneously to surface critical risks and suggested mitigations across mixed changes.

You need to provide the pull request number to start the security review flow. The analysis also requires access to PR details, repository standards, architecture references, and CI/CD baseline rules to generate actionable findings.

The best way to post actionable security findings is by running an automated OWASP review that generates PR comments with attack vectors, confidence levels, and remediation steps. It leverages framework-aware analysis to align findings with project context.

You should not use automated OWASP security checks for pull requests lacking defined repository standards or architecture references. Without baseline rules and infrastructure context, the review cannot effectively suppress false positives or classify findings accurately.