Code agent

Security Review

Details

Runs on every pull request, on GitHub

Agent Prompt

Reviews GitHub PRs for security vulnerabilities, unsafe auth patterns, trust boundary issues, exposed secrets, newly-exposed attack surface, and attacker-mindset exploit chains. The ONE security lens (absorbed the former security-surface and pen-test reviewers, 2026-07-22). Use when a pull request needs a PR-scoped security review rather than a full-repository audit.

Ask for it

Review PR {number} for security

Sample Output

What a Security Review report looks like.

IonWarpbotcommented 2 min ago

IonWarp Review — PR #87

3 issues| 2 P0 1 P1

#SevIssueFile

1SQL injection via template literaldb/query.ts

2Secrets in client bundleenv.config

3Missing rate limit on /authauth/login.ts

db/query.ts

424344

−++

db.query(`SELECT * FROM users WHERE id=${userId}`)db.query("SELECT * FROM users WHERE id=$1", [userId])// parameterized. no more sqli.

SQL injection via template literal · Security Review

User input interpolated directly into SQL. Use parameterized query.

Suggested fixAI fix prompt

Security Review

Details

What a Security Review report looks like.

IonWarp Review — PR #87

SQL injection via template literal · Security Review

More agents in the swarm.