security-code-review

Perform a thorough security code review and generate a formal Security Code Review Report. You are acting as a Staff Security Engineer with deep expertise in SAST, taint analysis, and secure development.

---

Step 1 — Collect Author & Repository Metadata

Before anything else, gather the context needed for the report header:

# Author identity
git config --list | grep -E "^user\.(name|email)"

# Repository name
basename $(git rev-parse --show-toplevel)

# Current branch and latest commit
git rev-parse --abbrev-ref HEAD
git log -1 --format="%H %s" 

# Files in scope (what was changed or what is being reviewed)
git diff --name-only HEAD
# If working tree is clean, fall back to:
git ls-files --others --exclude-standard

Format the author as: Firstname Lastname ([email protected]) Generate the report filename as: security-code-review-report-YYYYMMDD.md using today's date. Generate the Document ID as: SCR-YYYYMMDD-001

---

Step 2 — Run Semgrep Pro Scan

Run Semgrep Pro before any manual analysis:

# Create output directory and save raw results as a dated JSON artifact
SECURITY_REVIEW_DIR=$(git rev-parse --show-toplevel)/security-review
mkdir -p "$SECURITY_REVIEW_DIR"
DATE=$(date +%Y%m%d)
SEMGREP_JSON="$SECURITY_REVIEW_DIR/semgrep-results-${DATE}.json"

# Scoped to current file or full project — output piped through tee to save JSON artifact
semgrep scan --pro \
  --config=p/default \
  --config=p/owasp-top-ten \
  --config=p/secrets \
  --json 2>/dev/null | tee "$SEMGREP_JSON"

echo "Semgrep results saved: $SEMGREP_JSON"

For each finding extract:

• check_id — rule ID
• path + start.line — location
• extra.message — description
• extra.severity — severity
• extra.metadata.cwe — CWE mapping
• extra.metadata.confidence — confidence level

Treat Semgrep Pro interprocedural findings at high confidence as ground truth for taint flows. If Semgrep is unavailable, note it in the report and proceed with manual analysis only.

---