security-reviewer

To scan for OWASP Top 10 vulnerabilities and exposed secrets, run the security-reviewer against your repository. It applies automated threat-modeling checks across injection, authentication, and cryptography to identify security risks in your code.

Yes, you can automate security code review for pull requests by integrating the security-reviewer into your CI pipeline. It evaluates code changes against a defined security checklist and outputs a structured Markdown report to prevent vulnerable code from merging.

Automated secret detection and OWASP vulnerability checks apply to software repositories across multiple programming languages. The security review identifies exposed credentials and insecure configurations regardless of the specific codebase language.

The best way to document security findings for remediation is generating a structured Markdown report. The security-reviewer outputs actionable findings to bots/review-security.md, detailing detected vulnerabilities, secret exposure, and insecure configurations with steps for resolution.

An automated code vulnerability scan includes checks for injection flaws, authentication and authorization weaknesses, secret exposure, XSS, CSRF, input validation, and cryptography issues. These checks conform to a defined OWASP Top 10 security checklist.

To fix insecure configurations detected during a repository security review, consult the actionable remediation steps in the generated bots/review-security.md file. This structured security report provides specific guidance for resolving identified vulnerabilities.