PullPlane's Security Reviewer role checks the implementation and card context for realistic vulnerabilities, documents evidence and impact, and leaves the final risk decision with the team.
A focused security review
The Security Reviewer is instructed to inspect authorization boundaries, input validation, secret exposure, injection, unsafe network or filesystem access, dependency risk, and abuse cases relevant to the changed code. It should verify findings against the implementation and avoid speculative noise.
Each useful finding names its impact, supporting evidence, and a concrete remediation. The role can use a supported Claude or Codex model while keeping the same security responsibility.
Security as a merge gate
A project can require a read-only Security attestation for matching card priorities. The gate reviews the exact pull-request commit and reports pass, warning, or fail without modifying the repository.
- Use a scoped threat or trust-boundary question
- Distinguish verified vulnerabilities from open questions
- Require a human to decide whether a warning is acceptable
No automated security guarantee
An agent review does not replace secure design, dependency controls, specialist testing, or human review. Treat the report as another evidence source in the merge decision, especially when the code handles credentials, permissions, or untrusted input.