security

Run a security review by invoking the /security command on your current Git diffs or specific file sets. It performs threat modeling, OWASP Top 10 checks, and authentication validation, then outputs a structured Security Review Report with actionable fixes.

Threat modeling for code changes involves a phased workflow: scoping the changes, building a threat model, reviewing the code, and generating a report. This process surfaces threats across API, authentication, data handling, and configuration areas.

Yes, you can scan unstaged Git changes or the previous commit for OWASP Top 10 vulnerabilities. The security review identifies risks like input sanitization flaws and authorization issues, providing recommended mitigations.

Yes, the security review validates both authentication and authorization logic within your code changes. It checks for proper auth and authz implementation alongside input sanitization reviews to ensure comprehensive API and data handling protection.

Perform a code security review after implementing features or before submitting a PR. Running the review at these stages surfaces vulnerabilities and provides actionable fixes to strengthen PR hygiene and post-merge quality.

The best way to find configuration and data handling risks is running a security review on the previous commit. The review applies threat modeling and OWASP checks to your diffs, generating a structured report with identified threats and remediation suggestions.