vasuag09 /security-review — security gate
Goal: no Critical/High vulnerability and no leaked secret ships.
Do this
- Delegate to
harness-claude:security-reviewerwith the diff or named files. - It hunts (with exploit paths, not just patterns): hardcoded secrets, injection (SQL/command/deserialization), XSS, broken access control, SSRF, path traversal, weak crypto, missing validation, error leakage, vulnerable deps. It also runs a secret check against the diff.
- For each Critical/High: fix before continuing, and leave a regression test that fails on the vulnerability and passes after the fix — so the same hole can't silently reappear. If a secret is exposed — stop, rotate it, then sweep for the same class elsewhere.
When to invoke
Always for auth/payments/user-data/file/external-call changes. For purely internal, non-sensitive refactors, a lighter pass is fine — but never skip the secret check.
Exit criterion
Verdict = pass (no Critical/High), secret check clean. Then /harness-claude:test.