Security audit
Assign a branch, PR, feature area, or repo slice and the reviewer traces attacker input to sinks, checks auth and CI risks, scans dangerous patterns where possible, and returns high-confidence findings with fixes.
Saves you ~3 h / run
How it works
- Trigger
- When you start the “Security audit delivery” workflow.
- Job
- Perform and verify an exploitability-first security audit.
- Outcome
- A tested implementation and pull request draft.
What it installs
Agents 2
-
Security Reviewer
Reads diffs and surrounding code, traces input to sinks, checks CI/dependency risk, and returns high-confidence findings with fixes.
-
Security audit Quality Reviewer
Checks primary evidence, domain controls, deliverable completeness, and communication quality, stopping the run when the work is wrong, unsupported, incomplete, or uncertain.
Teams 1
-
Security audit quality team
The delivery agents produce the work while an independent quality reviewer checks each workflow handoff against explicit evidence, domain, and communication requirements before the run can continue.
Workflows 1
-
Security audit delivery
Perform and independently verify an exploitability-first security audit before human review.
Goals 1
-
Security findings verified
Keep security reports high-confidence, actionable, and low-noise. Success looks like: Every assigned audit reviews the full scoped input, traces attacker input to sinks, checks CI and dependency risk where relevant, and reports only verified findings with fixes.
Skills 3
-
security-review
Exploitability-first security review: trace attacker-controlled input to sinks, skip framework-mitigated false positives, classify severity, and report concrete fixes. Adapted from getsentry/skills/security-review.
-
gha-security-review
GitHub Actions and CI security review for workflow triggers, token permissions, untrusted input, third-party actions, secrets, caches, documents, and supply-chain risk. Adapted from getsentry/skills/gha-security-review.
-
code-security
Language-aware secure-coding checks across common vulnerability classes, including OWASP Top 10, infrastructure-as-code, and Semgrep-style static analysis rules. Adapted from semgrep/skills/code-security.
Requirements
- Connected repository — Needs repository access so the agent can read the full diff, surrounding code, CI configuration, dependency manifests, and existing security tests.
Setup guide
How to Automate Security Audits
A practical guide to running exploitability-first security audits with scoped code review, CI checks, and approval gates.
Read the setup guideDon't see your workflow? Describe it.
A sentence or two about a recurring job is enough. We design the playbook that runs it and show you exactly what it saves.