validate-security

To scan git diffs for security vulnerabilities, invoke the /validate command against staged or unstaged changes. The validator analyzes the code diff and returns a structured JSON report detailing any detected vulnerabilities.

Static analysis of code changes detects secrets, credentials, injection flaws, path traversal, insecure configurations, and authentication gaps. It categorizes these findings into hard, should, and warn violations to guide remediation.

Yes, the security validator supports batched processing for large codebases by batching up to 50 files per run. This allows scalable validation of staged files and git diffs without overwhelming the analysis process.

Yes, you can catch hardcoded secrets and credentials in staged files. The validator operates on staged and unstaged git diffs, flagging them as hard violations in the structured JSON report to prevent insecure code from shipping.

To get an auditable report of security violations, run the validator on your git diff. It outputs a structured JSON report containing the pass or fail verdict, detailed violations, and affected files to guide fixes during code review.

The file limit for analyzing code changes is 50 files per run. The validator reads git diffs from HEAD~1, staged, or unstaged states and batches processing to handle this volume efficiently.