security

Security review — authentication, user input, secrets, API endpoints, OWASP Top 10

Invoke the security-reviewer agent to perform a comprehensive security review.

If an argument is provided and is a number, treat it as a GitHub PR number. If no argument, review local uncommitted changes (git diff --staged and git diff).

The agent will:

  1. Establish review scope (PR or local diff)
  2. Scan for secrets, credentials, or sensitive data exposure
  3. Review against OWASP Top 10 (injection, XSS, SSRF, insecure crypto, broken auth)
  4. Flag authentication/authorization issues, unsafe input handling, and API vulnerabilities
  5. Report findings with severity levels (INFO / MEDIUM / HIGH / CRITICAL)

After the review, address all HIGH and CRITICAL issues before running /dog:prp-pr.