Review security-sensitive code for serious flaws such as broken access control, tenant isolation errors, injection, exposed secrets, SSRF, and unsafe file handling. Confirm high-severity findings, fix them, and report remaining issues with their impact.
Check code for the most common, high-risk security vulnerabilities (broken access control, tenant isolation, injection, secrets, SSRF, auth/session, unsafe file handling, mass assignment) before it ships. Use after editing any API controller, guard, or auth code (apps/api/src/auth/**), a Prisma schema/query, a file-upload/webhook handler, or before committing/pushing security-sensitive changes.
Run score Not tested
See how to installReview the instructions the agent will receive before you install.
Review code for high-risk security vulnerabilities and fix confirmed high-severity issues immediately. Complements CI (CodeQL/Dependabot/SBOM) by catching logic/design flaws those miss — do not re-flag dependency CVEs or generic lint.
$ARGUMENTS names files/dirs, review those.git diff --name-only origin/main...HEAD (fall back to git diff --name-only for uncommitted work). Skip generated files, lockfiles, and *.spec.ts (unless the change is in a spec).Review whenever the change touches a trust boundary or a resource — judge by behavior, not path. That includes: any controller or service (services are where IDOR, tenant-scoping, and mass-assignment bugs actually live), Next.js route handlers (app/api/**, route.ts), Trigger.dev jobs (apps/api/src/trigger/** — SSRF, elevated context), guards/auth (apps/api/src/auth/**, packages/auth/**), any Prisma query (especially lookups/updates/deletes by a client-supplied id → IDOR), middleware, file upload/storage, webhooks, outbound requests to a dynamic URL, crypto/token handling, and any frontend that renders user-supplied HTML or builds redirects from input.
Only if the change is genuinely non-security (pure presentation, types, copy, config with no secrets) — say so and stop, don't invent findings.
Dispatch the security-reviewer agent on the scoped files. For a broad review (a full PR / many files), fan out parallel security-reviewer agents by dimension group so coverage is thorough:
@RequirePermission, API-key/service-token scope enforcement, authz-vs-attribution, IDOR, organizationId scoping.dangerouslySetInnerHTML/unsanitized HTML, ...dto spread into create/update.The agent's full checklist lives in .claude/agents/security-reviewer.md.
For each P1/P2 finding, adversarially verify before acting: dispatch one security-reviewer (or read the code yourself) prompted to refute it — trace the guard→controller→service→DB path. Drop anything that can't be confirmed. Attribution-only use of a resolved actor, org-scoped queries, and parameterized Prisma are NOT findings.
P1/P2 issues immediately (mirror the surrounding code; add a regression test for auth/attribution changes).P3s and anything needing a product decision, with severity · file:line · exploit/impact · fix.bunx turbo run typecheck --filter=@trycompai/api --filter=@trycompai/app after fixes.No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Guide API endpoint changes so request DTOs, runtime validation, OpenAPI documentation, and MCP tool metadata stay aligned. It covers discoverability, authentication, uploads, long-running tasks, and response types that MCP tools cannot handle.
Review specified files for design system usage, replace legacy @trycompai/ui components and lucide-react icons with available @trycompai/design-system equivalents, and run the app type check to verify the migration.
Review specified files for outdated hook and API patterns, then replace them with the prescribed SWR hooks, API clients, or server API calls. The guidance covers data fetching, mutations, cache updates, and response handling, followed by a typecheck command.
Review NestJS API endpoints and frontend components for role-based access control and audit log compliance. The skill lists permission, guard, route, and UI gating rules, then directs the agent to fix violations and run type checks.
Audit unit tests for components that use permissions. Add missing tests and fix failures, checking that administrators can use mutation controls, auditors cannot, and read-only content remains visible to both.
Set up Better Auth for TypeScript applications, including server and client configuration, database adapters, sessions, email and social sign-in, and plugins. The guide also highlights environment variables, schema generation, and security settings to review.