Security Review

When to Use

• The user wants a security audit of their application, infrastructure, or specific feature
• They need a threat model before launching or a penetration test preparation review
• They have a dependency vulnerability alert and need remediation guidance
• They are handling sensitive data (PII, payment, health) and need verification
• Code audit, secrets detection, or compliance assessment is requested

Context Required

From startup-context: tech stack, deployment environment, compliance requirements, data types. Also ask:

• Scope — Full app, feature, auth system, single PR, infrastructure, or cloud environment
• Data types — PII, payment, health, credentials, or other sensitive data handled
• Compliance requirements — SOC 2, HIPAA, PCI-DSS, GDPR, ISO 27001
• Authorization — Confirm written authorization exists before any active testing

Workflow

Follow a five-phase methodology. Automated scanning precedes manual review. Authorization verification is mandatory before active testing.