Identify scope:

git status --short
git branch --show-current
git log --oneline -5

Determine the diff:
- Use the user-provided range when available.
- Otherwise review local unstaged/staged changes.
- For branch review, compare against the inferred base branch.
Inspect:
```
git diff --stat
git diff
```
Read changed files and relevant surrounding code.
Review uncommitted changes too when present.
Run a security-focused pass:
- Malicious or obfuscated code, dynamic evaluation, encoded strings, hidden network calls, or data exfiltration.
- Suspicious dependency additions or version changes.
- Hardcoded secrets, tokens, API keys, credentials, or sensitive logs.
- Backdoors, reverse shells, unauthorized remote access, or unsafe process execution.
- Unsafe deserialization, command injection, SQL injection, XSS, path traversal, or SSRF.
- Weakened authentication, permissions, validation, or authorization checks.
- Suspicious file system or environment variable access.
Check tests or validation paths for changed behavior.
Verify whether each finding is actionable and grounded in code.

Output Format

Start with findings, ordered by severity. Each finding must include:

Then include:

If there are no findings, say that clearly and mention residual risk or missing validation.

Guardrails