appsec-review

Application Security Review

Target: $ARGUMENTS (optional PR number, branch, commit range, or path; default to the current branch against the remote default branch)

Objective

Review only newly introduced application-layer vulnerabilities in the requested change set. Optimize for high-confidence, exploitable findings with real attacker value. Think in terms of trust boundaries, attacker-controlled inputs, privilege changes, unsafe parsing, outbound request control, data exposure, and framework-specific behavior across TypeScript, Node.js, Python, Rust, and modern web stacks.

Favor signal over coverage. Missing a speculative issue is better than shipping a noisy report.

Workflow

Progress checklist:

Application Security Review:
- [ ] Step 1: Resolve the review scope
- [ ] Step 2: Build repository security context
- [ ] Step 3: Generate candidate vulnerabilities
- [ ] Step 4: Filter false positives in parallel
- [ ] Step 5: Publish the final markdown report

Step 1: Resolve the Review Scope

• If $ARGUMENTS looks like a PR number and GitHub context is available, gather the PR metadata first and review that diff.
• Otherwise resolve the local review base from origin/HEAD. If the default branch is unclear, inspect git remote show origin.
• Capture the complete review context:
  • git status
  • git diff --name-only <base>...HEAD
  • git log --no-decorate <base>...HEAD
  • git diff <base>...HEAD
• Use git show <commit> when a suspicious commit needs narrower intent or before/after context.
• If remote comparison is unavailable, fall back to staged plus unstaged local diff and say so explicitly in the review setup.

Step 2: Build Repository Security Context

• Read adjacent code instead of reviewing the raw diff in isolation.
• Identify the stack, auth model, tenant model, validation patterns, templating paths, serializers, and secret-handling conventions used near the changed files.
• Compare the new code against nearby secure patterns before declaring a finding.
• Load references/review-playbook.md for threat-model questions, attack-surface coverage, and stack-specific heuristics.