security-sweep

Security Sweep

Scan the codebase for dangerous constructs, then use the graph to answer the question a flat scanner cannot: can untrusted input actually reach this? A medium-severity finding in a request handler outranks a critical one in dead code, and only the call graph can tell them apart.

Command surface: run the local CLI through the coding harness shell. Examples use the installed better-code-review-graph command; from a source checkout, prefix it with uv run. No MCP mapping is required.

Steps

1. Make the graph current with better-code-review-graph graph build --base HEAD --repo-root "<path>". Findings are attached to graph nodes, so anything unindexed is unscanned.

2. Read the active ruleset with better-code-review-graph security rule_list --engine heuristic before scanning, and check which languages each rule declares. This determines what a clean result is worth -- see Coverage Limits below.

3. Run the Tier 1 scan: better-code-review-graph security scan --engine heuristic --repo-root "<path>". It returns total, by_severity, by_rule, tags_by_node, and suppressed_count. Tier 1 is regex matching over the source of function, class, and method nodes -- fast, no external tool, no data-flow analysis.

4. Run Tier 2 when it is available: better-code-review-graph security scan --engine semgrep --repo-root "<path>". Semgrep is an opt-in extra and is not installed by default.

   • When the CLI is missing the command returns {"error": ..., "engine": "semgrep"} with a non-zero exit.
   • Treat that as not run, never as clean. Report Tier 2 as unavailable instead of silently reporting Tier 1 numbers as the whole picture.

5. Rank findings by reachability -- the step that makes this a graph sweep rather than a grep. For each tagged node, walk backwards toward the entry points:

   • better-code-review-graph query query --pattern callers_of --target "<node>" --repo-root "<path>"
   • Repeat on the callers, two or three hops, until you reach either an entry point (route handler, CLI command, worker, event consumer) or nothing.
   • A node with no callers is either dead code or an entry point itself. Distinguish the two before ranking: an unreferenced HTTP handler is the most exposed code in the repository, not the least.