speckit-security-review-staged

You can review staged source-code changes by analyzing the git diff limited to the commit index. The Skill audits injection risks, hardcoded secrets, authorization gaps, and insecure cryptography, producing structured findings with severity, CWE IDs, and remediation backlogs.

A pre-commit code review can detect injection risks, hardcoded secrets, authorization gaps, insecure cryptography, misconfiguration, input validation failures, and dependency supply-chain concerns. Findings are mapped to OWASP categories and CWE IDs with CVSS guidance.

Yes, this security review tool requires Spec-Kit project structure support. It relies on Spec-Kit's workflow scripts to detect changed files in the git index and determine the exact audit set for your staged diff.

Yes, you can limit vulnerability analysis to only the files in your git index. The Skill performs a staged-only security review, which reduces noise from unrelated parts of the codebase and makes security checks faster and more actionable.

The best way to scan for hardcoded secrets in a pull request diff is to audit the staged source-code changes directly. This applies to pull-request workflows by evaluating diffs for credentials and producing structured findings with an optional memory capture step.