security-review

Review code for high-risk security vulnerabilities and fix confirmed high-severity issues immediately. Complements CI (CodeQL/Dependabot/SBOM) by catching logic/design flaws those miss — do not re-flag dependency CVEs or generic lint.

1. Scope

• If $ARGUMENTS names files/dirs, review those.
• Otherwise review the current change set: git diff --name-only origin/main...HEAD (fall back to git diff --name-only for uncommitted work). Skip generated files, lockfiles, and *.spec.ts (unless the change is in a spec).

Review whenever the change touches a trust boundary or a resource — judge by behavior, not path. That includes: any controller or service (services are where IDOR, tenant-scoping, and mass-assignment bugs actually live), Next.js route handlers (app/api/**, route.ts), Trigger.dev jobs (apps/api/src/trigger/** — SSRF, elevated context), guards/auth (apps/api/src/auth/**, packages/auth/**), any Prisma query (especially lookups/updates/deletes by a client-supplied id → IDOR), middleware, file upload/storage, webhooks, outbound requests to a dynamic URL, crypto/token handling, and any frontend that renders user-supplied HTML or builds redirects from input.

Only if the change is genuinely non-security (pure presentation, types, copy, config with no secrets) — say so and stop, don't invent findings.

2. Review

Dispatch the security-reviewer agent on the scoped files. For a broad review (a full PR / many files), fan out parallel security-reviewer agents by dimension group so coverage is thorough:

• Access control & tenancy — guards, @RequirePermission, API-key/service-token scope enforcement, authz-vs-attribution, IDOR, organizationId scoping.
• Injection, XSS & mass assignment — raw Prisma/SQL, command/path injection, dangerouslySetInnerHTML/unsanitized HTML, ...dto spread into create/update.
• Secrets, SSRF, auth/session & file handling — hardcoded/logged secrets, outbound fetch to user URLs, session/cookie/attribution boundaries, S3/upload safety, DoS, info disclosure.

The agent's full checklist lives in .claude/agents/security-reviewer.md.

3. Verify (no false positives)

For each P1/P2 finding, adversarially verify before acting: dispatch one security-reviewer (or read the code yourself) prompted to refute it — trace the guard→controller→service→DB path. Drop anything that can't be confirmed. Attribution-only use of a resolved actor, org-scoped queries, and parameterized Prisma are NOT findings.

4. Fix & report

• Fix confirmed P1/P2 issues immediately (mirror the surrounding code; add a regression test for auth/attribution changes).
• Report P3s and anything needing a product decision, with severity · file:line · exploit/impact · fix.
• Run bunx turbo run typecheck --filter=@trycompai/api --filter=@trycompai/app after fixes.
• End with a one-line verdict: clean, or the highest-priority action remaining.