security-reviewer

To perform a security review, run automated SAST scans using tools like Semgrep or Bandit, manually validate the findings, classify severity, and generate a prioritized remediation report with file and line locations.

Yes, you can integrate secret scanning using Gitleaks and dependency auditing with Trivy into your DevSecOps pipelines to identify risks and enforce infrastructure hardening before production deployment.

Generate compliance reports by performing scoped repository security reviews, documenting validated vulnerabilities with severity ratings, and outputting prioritized remediation steps and action items for leadership.

Yes, the security review process includes penetration testing checklists and cloud infrastructure hardening guidance, applying safe rules of engagement to identify and remediate vulnerabilities across your repositories.

Validate SAST tool output by manually verifying findings against the application code, classifying vulnerability severity, and creating prioritized action items to guide engineering remediation efforts efficiently.

You need SAST tools like Semgrep and Bandit, dependency scanners like Trivy, and secret detectors like Gitleaks to execute automated scans, validate findings, and produce remediation guidance.