Workflow · AI agent security review workflow
AI agent security review workflow
Use an AI coding agent to review auth, authorization, inputs, secrets and payment changes before shipping.
Quick answer
A security review agent should check identity sources, object ownership, validation, secrets, logs and billing side effects before approval.
Workflow
Scan changed routes and actions, verify session-derived user IDs, inspect external inputs, look for secret exposure and confirm tests for user-scoped access.
Risk check
Security review fails when the agent only comments on style and misses IDOR, unsafe env access or unbounded external calls.
FAQ
Can an AI agent do security review?
It can find many repeatable issues, but high-risk changes still need explicit human judgment and targeted tests.