Awesome Reviewers

Verification · Code review

Security-focused review

A reviewer that reads for exploitable behaviour across files: authorization gaps, injection through helpers, unsafe trust between services.

Sub-techniques

  • Should-review gate V1038.001

    Decide from the diff whether a deeper security pass is warranted.

  • Call-chain investigation V1038.002

    Follow user input from entry point to sink with a model, file by file.

  • OWASP classification V1038.003

    Tag each finding with an OWASP Top 10 category for routing and reporting.

How to build it

  1. Gate on diff signals: new routes, auth code, deserialization, subprocess, SQL.
  2. Investigate from the entry point to the sink, not file by file.
  3. Require a concrete input that reaches the sink.

Signals in a repository

  • SECURITY.md, threat model docs, or a security review workflow on paths like auth/ or api/.