Security Review
Use this workflow before merging or releasing change sets that touch authentication, data handling, network surface, infrastructure-as-code, or third-party dependencies.
Workflow
- Establish the diff scope:
git diff origin/main...HEAD --stat and a list of changed files.
- Spawn the
security-auditor subagent in parallel for each concern below. Each subagent reads only the diff plus immediately relevant context.
- Injection: SQL/NoSQL, command, template, deserialization, prompt injection in LLM-touching code.
- Authn/Authz: token handling, session, RBAC checks, privilege escalation.
- Secrets: hard-coded credentials, leaked keys, insufficient redaction in logs.
- Supply chain: new or updated dependencies, lockfile integrity, pinned versions.
- Infrastructure-as-code: open security groups, public buckets, missing encryption, weak defaults.
- Business logic: state-machine bypasses, atomicity violations, replay/race conditions.
- Each subagent returns findings ranked by severity with file/line citations.
- Verify each candidate finding against actual code behavior to filter false positives.
- Combine and dedupe results into a single severity-ordered list.
Constraints
- Do not exfiltrate secrets discovered during review; redact in the report.
- Treat "best practice" suggestions as low priority unless they map to a concrete risk.
- Cite OWASP Top 10 / CWE IDs where they sharpen the finding.
Final Report
Lead with verdict: Ready to Merge / Needs Attention / Needs Work. Then list findings by severity (Critical / High / Medium / Low / Info) with file, line, what fails, why it matters, and a concrete fix direction. End with verification reviewed and remaining gaps.
1---2name: security-review3description: Run a multi-pass security review over the current diff using parallel specialist subagents focused on injection, authn/authz, secrets, supply-chain, and infrastructure-as-code risks.4---56# Security Review78Use this workflow before merging or releasing change sets that touch authentication, data handling, network surface, infrastructure-as-code, or third-party dependencies.910## Workflow11121. Establish the diff scope: `git diff origin/main...HEAD --stat` and a list of changed files.132. Spawn the `security-auditor` subagent in parallel for each concern below. Each subagent reads only the diff plus immediately relevant context.14 - **Injection**: SQL/NoSQL, command, template, deserialization, prompt injection in LLM-touching code.15 - **Authn/Authz**: token handling, session, RBAC checks, privilege escalation.16 - **Secrets**: hard-coded credentials, leaked keys, insufficient redaction in logs.17 - **Supply chain**: new or updated dependencies, lockfile integrity, pinned versions.18 - **Infrastructure-as-code**: open security groups, public buckets, missing encryption, weak defaults.19 - **Business logic**: state-machine bypasses, atomicity violations, replay/race conditions.203. Each subagent returns findings ranked by severity with file/line citations.214. Verify each candidate finding against actual code behavior to filter false positives.225. Combine and dedupe results into a single severity-ordered list.2324## Constraints2526- Do not exfiltrate secrets discovered during review; redact in the report.27- Treat "best practice" suggestions as low priority unless they map to a concrete risk.28- Cite OWASP Top 10 / CWE IDs where they sharpen the finding.2930## Final Report3132Lead with verdict: `Ready to Merge` / `Needs Attention` / `Needs Work`. Then list findings by severity (Critical / High / Medium / Low / Info) with file, line, what fails, why it matters, and a concrete fix direction. End with verification reviewed and remaining gaps.
s-hiraoku