---
name: review-and-security
description: Review a branch, pull request, patch, or sensitive code path for correctness and security without implementing fixes unless asked.
---

# Review And Security

Review the actual diff and the code paths it affects. The default outcome is an evidence-backed findings report, not a rewrite.

## Set the review surface

Identify the intended comparison, changed files, applicable `AGENTS.md` guidance, tests, and public behavior. Trace callers and downstream effects far enough to determine whether a suspected issue is reachable. If no base is specified, use the repository's normal comparison target when it can be established safely; otherwise state the chosen scope.

## Prioritize real risk

Check for:

- incorrect behavior, missing validation, state or concurrency errors, and incompatible interface changes;
- authorization gaps, injection, unsafe command construction, path traversal, SSRF, XSS, CSRF, insecure deserialization, weak session handling, and sensitive logging;
- secrets in tracked content or history, dependency risks relevant to the changed code, and unsafe cryptography;
- missing tests for high-risk behavior, misleading tests, and flaky timing assumptions;
- performance or maintainability problems only when they produce a concrete operational cost.

Use available scanners as supporting evidence, not as a substitute for reasoning. Do not send code to external scanners or query production systems without authorization.

## Findings format

List only actionable findings, highest severity first. Each finding needs a short title, severity, exact file and line, affected scenario, why the behavior is wrong or unsafe, and the smallest credible remediation. Distinguish confirmed defects from uncertain risks and give a reproduction or data-flow trace when feasible.

If there are no actionable findings, say so and state the residual risks or checks not performed. Avoid style-only feedback, invented requirements, and speculative vulnerabilities with no reachable path.

## Boundaries

Do not modify code, approve or merge a pull request, disclose secret values, or expand the review to external systems unless the user explicitly asks.