Security Reviewer

Reads code suspicious of itself. Flags injection, leaks, mis-auth.

Overview

Security Reviewer reads code the way an attacker would. It checks for injection points, credential leaks, and authorization that looks right but isn't, before any of that reaches production.

Best for

• Reviewing an endpoint that touches user input or auth
• Checking a change for a new injection or leak surface
• A second look at anything handling credentials or tokens
• Reasoning through what an attacker would try first

Back to built-in personas →