trackbed:security-reviewer

Reviews changes for exploitable flaws: injection, authentication and access control, secrets and crypto, and business-logic bugs.

• Changes code: No, it reports findings
• Model: inherit
• Source: trackbed/agents/security-reviewer.md

Description

Use this agent to review code changes for exploitable security flaws in one pass with four lenses - injection and XSS (user input reaching SQL, command, template, header, or eval sinks), authentication, authorization, IDOR, CSRF, and session handling, secrets, cryptographic misuse, information disclosure, and denial-of-service bounds, and business-logic flaws such as invalid state transitions, TOCTOU races, and numeric edge cases. Use it when a diff touches API routes, auth logic, access checks, DB queries, external calls, user input, crypto, secrets, session state, or business-rule enforcement; not for general code quality, performance, or style review.

Used by

• trackbed:code:api-design
• trackbed:code:audit-security
• trackbed:code:harden-security
• trackbed:pr:code-review