security-scan-diff

To scan a git diff for malicious code changes, compare a target tag or commit against HEAD to analyze CI files, source code, and docs. This generates a structured security report highlighting secret exposure, code injection, and dependency tampering risks.

Security risks detected in CI/CD workflow and configuration diffs include secret exposure, code injection vulnerabilities, and dependency tampering. Parallel subagents analyze these file changes between your target reference and HEAD to surface potential malicious modifications.

Automated security review handles dependency tampering by running parallel subagent checks across source code diffs. It identifies unauthorized dependency modifications between a commit and HEAD, returning a unified report of tampering risks.

You can generate a comprehensive security assessment for all changes since the last git tag by comparing the tag against HEAD. The review processes CI/CD workflows, code, and documentation to produce a structured security report.

The security review works with documentation changes by analyzing docs alongside CI files and source code. It checks diffs between a target reference and HEAD to detect malicious changes within documentation files.

The best way to automate malicious code detection in code review diffs is running parallel subagent checks across CI, source, and docs. This analyzes diffs between a commit and HEAD, returning a structured report of injection and exposure risks.