Everything you can build with AI

Runs a full security review of the pending changes on your branch.

Reviews auth, input handling, secrets and APIs before release, using a practical security checklist.

Builds a precise picture of code flow, assumptions and dependencies before a security audit, so findings have context.

Security-reviews a code diff: blast radius of the change, regression risk and missing tests.

Runs and guides Semgrep code scans and triages the results. Some features are optional paid extras.

Spots APIs and settings that are easy to misuse or that invite security mistakes.

Audits dependency and supply-chain risk from lockfiles, advisories, install behavior and publisher signals.

Audits GitHub Actions that use AI agents, especially the risk of untrusted input reaching the agent.

Guides data-flow and vulnerability analysis with CodeQL. Needs the tool and a database for your code.

Writes custom Semgrep rules with examples and tests to prove they catch the intended pattern.

After one bug is found, hunts for other copies of the same flaw across the codebase.

Checks sensitive and crypto code for timing leaks, where run time reveals secret data. A defensive specialist skill.

Reads, merges and filters SARIF reports from scanning tools.

Scans a whole repo or just your changes for security issues and can suggest verified patch files you apply yourself.