speckit-security-review-branch

To run a security review on a git diff, the tool identifies changed files in your pull request and analyzes only the introduced code changes for vulnerabilities like injection and hardcoded secrets. It outputs severity-tagged findings with remediation guidance.

Diff-scoped vulnerability triage is the process of auditing only the code changes introduced in a branch rather than the entire codebase. This targets security risks like broken access control, insecure cryptography, and misconfigurations specifically within your git diff.

Yes, the security review checks changed files for OWASP categories and CWE vulnerabilities. It analyzes the diff for injection risks, authorization flaws, input validation issues, and insecure data handling, generating actionable findings with prioritized action steps.

Yes, you can use memory-md context to apply security constraints during branch analysis. The review optionally leverages memory-md context or explicit markdown document reads to preserve durable guidance patterns and satisfy Spec-Kit integration requirements.

The best way to triage hardcoded secrets in feature branch development is to use a diff-scoped review that targets only the updated code. This quickly identifies sensitive data handling issues across the introduced changes without scanning the entire repository.