speckit-security-review-branch

What problem does it solve?

It reduces the risk of shipping vulnerable code by focusing a security review specifically on what changed in a branch or pull request diff, rather than auditing the entire codebase.

Core Features & Use Cases

• Diff-Scoped Security Review: Audits only the introduced changes by determining the review scope from user-supplied branches or by detecting changed files.
• Targeted Vulnerability Analysis: Checks the diff for injection risks, hardcoded secrets, broken access control, insecure cryptography, misconfigurations, and insecure data handling.
• Spec-Kit Memory Hub Integration: Optionally uses memory-md context or a markdown-only fallback to apply security constraints and preserve durable guidance patterns.
• Actionable Findings Output: Produces severity-tagged findings with OWASP category, CWE, remediation guidance, and prioritized action steps.

Quick Start

Run the branch security review for your PR changes to get a targeted security report for the updated code only.