When to Use
- Reviewing pull requests or commits for security implications
- Assessing whether a code change introduces new vulnerabilities
- Comparing before/after states of security-sensitive code
- Evaluating dependency updates for security impact
- Reviewing infrastructure-as-code changes for security regressions
When NOT to Use
- Full codebase security audits (use audit-context-building first)
- Reviewing code without access to the diff
- Performance or feature reviews without security focus
Review Methodology
1. Understand the Change Context
# View the full diff
git diff main..feature-branch
# See changed files
git diff --name-only main..feature-branch
# Check commit messages for security context
git log --oneline main..feature-branch
2. Categorize Changed Files by Risk
| Category | Examples | Review Priority |
|---|---|---|
| Auth/authz | Login, middleware, RBAC | Critical |
| Input handling | Parsers, validators, API handlers | High |
| Crypto/secrets | Key management, encryption, hashing | Critical |
| Data access | Database queries, ORM models | High |
| Configuration | Env config, security headers, CORS | High |
| Dependencies | package.json, go.mod, requirements.txt | Medium |
| Tests | Test files, fixtures | Low (but check for removed security tests) |
| UI/frontend | Templates, React components | Medium (XSS risk) |
3. Security-Focused Diff Analysis
Look for:
- Removed security checks (auth, validation, sanitization)
- New input handling without validation
- Changed trust boundaries
- Weakened cryptographic operations
- New dependencies with known vulnerabilities
- Hardcoded secrets or credentials
- Disabled security features (CSRF, CSP, rate limiting)
- Error handling changes that leak information
4. Dependency Change Review
# Compare dependency changes
diff <(git show main:package.json | jq '.dependencies') <(cat package.json | jq '.dependencies')
# Check new dependencies for vulnerabilities
npm audit
Red Flags in Diffs
| Pattern | Risk |
|---|---|
-if (user.isAdmin()) |
Removed authorization check |
+// TODO: add auth later |
Security debt introduced |
-sanitize(input) |
Removed input sanitization |
+eval(userInput) |
Code injection |
-helmet() |
Removed security headers middleware |
+CORS: { origin: '*' } |
Overly permissive CORS |
| Deleted test files | Removed security regression tests |
Output Format
For each finding:
- File and line — exact location in the diff
- Issue — what the security concern is
- Severity — Critical / High / Medium / Low
- Recommendation — specific fix or mitigation