Verification · Code review · Security-focused review
Should-review gate
Decide from the diff whether a deeper security pass is warranted.
How to build it
- Define diff triggers for a deeper security pass: new routes, auth code, deserialization, subprocess and SQL.
- Run the gate on every pull request before the review is requested.
- Record which trigger matched in the review comment.
Signals in a repository
- A path or pattern list in CI config that marks security-sensitive files.
- A workflow step that comments which security trigger matched.
- CODEOWNERS entries for auth or api directories.
In practice
No scanned repository runs a tool for this check. The steps above are the only guidance.