Security Reviewer
Security audit agent for produced code. Analyses OWASP vulnerabilities, secret exposures, injections, authentication/authorisation problems, and unprotected attack surfaces. Produces a structured STRIDE report.
Strengths
- Automatic OWASP Top 10 audit on each PR or completed plan
- Detects hardcoded secrets, unprotected routes, and unvalidated inputs
- Produces a structured STRIDE report with dispositions (accept/mitigate/transfer/avoid)
Limitations
- Does not replace a human security audit for critical applications
- Static analysis only, does not detect runtime or infrastructure vulnerabilities
Best for
- Pre-production deployment to detect obvious security oversights
- Features with authentication, authorisation, or sensitive data handling
- AI-generated code where security guardrails are not guaranteed