perform-security-review

Parameters

--base-ref <ref>: Branch comparison mode only. Use this ref as the diff base instead of probing for one. It still passes all three checks in step 1-A2, so an unresolvable or disconnected ref is rejected rather than trusted. Supply this when the probes in step 1-A2 would resolve the wrong base — a non-default trunk such as rc, or a repository where gh is unauthenticated so candidate 2 is unavailable. It does not rescue a default actions/checkout; references/base-ref-resolution.md says why and what does.

--output-dir <path>: When using --output file, write the report to <path>/security-review-YYYY-MM-DD-{identifier}.md instead of the current working directory. Tip: use --output-dir ~/.claude/security-reviews/ to keep reports outside git repos.

Security Review Mode

Determine review mode from the invocation. A PR number, commit SHA, or duration argument selects its own mode, and --base-ref selects branch comparison mode when no positional argument is given.

If a positional argument and --base-ref are both present, stop and report the conflict, naming both and asking for one. Launch no agents. Write the report to the resolved output destination, as the step 1-A2 abort does.

• PR mode (PR number or URL): gh pr view <number> for context, gh pr diff <number> for the diff.
• Commit mode (commit SHA): git diff <sha>..HEAD — reviews all changes after that commit.
• Time-based mode (duration, e.g., "last 48 hours"): find the oldest commit in range with git log --since="<duration>" --reverse --format=%H | head -1, then git diff <sha>^..HEAD to include it.
• Local changes mode (no PR, commit, or duration argument, no --base-ref, and pending changes exist): git diff HEAD for staged + unstaged changes.
• Branch comparison mode (no positional argument, and either --base-ref <ref> is given or the tree has no pending changes): git diff <base-ref>...HEAD — changes since the branch diverged from the base, resolved in sub-step A2 rather than assumed to be main. --base-ref selects this mode outright, so it works in a dirty tree, but a three-dot diff compares commits and leaves pending changes unreviewed. Run git diff --quiet HEAD here too and add the step 5 header's Pending changes: line when it reports dirty; without --base-ref, pending changes route to local changes mode instead.

Two of those modes turn on whether the tree is dirty. Test it with git diff --quiet HEAD, which exits 1 when pending changes exist.