<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Security Code Review — API Reference

## Review Workflow Commands

```bash
# Generate diff for review
git diff origin/main...HEAD -- '*.py' '*.js' '*.ts' > pr.patch

# Find security-sensitive files changed
git diff --name-only origin/main...HEAD | grep -iP "auth|crypto|security|session"

# Show functions changed
git diff origin/main...HEAD --stat
```

## Automated Assistants

```bash
# Semgrep on changed files only
semgrep scan --config p/security-audit --baseline-commit origin/main .

# Bandit on changed Python files
git diff --name-only origin/main...HEAD -- '*.py' | xargs bandit -f json

# ESLint security plugin
npx eslint --plugin security --rule 'security/detect-eval-with-expression: error' src/
```

## CODEOWNERS Syntax

```
# Security-sensitive paths require security team review
/src/auth/          @org/security-team
/src/crypto/        @org/security-team
/src/middleware/    @org/security-team
*.key               @org/security-team
*.pem               @org/security-team
```

## Review Focus Areas by CWE

| CWE | Category | What to Look For |
|-----|----------|-----------------|
| CWE-89 | SQL Injection | String concatenation in queries |
| CWE-79 | XSS | Unescaped user input in HTML |
| CWE-287 | Auth Bypass | Missing authentication checks |
| CWE-862 | Missing AuthZ | Endpoints without authorization |
| CWE-798 | Hardcoded Creds | Secrets in source code |
| CWE-330 | Weak Random | `random` instead of `secrets` |
| CWE-295 | Cert Validation | `verify=False` in HTTP calls |

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | No findings |
| 1 | Security findings detected |
| 2 | Analysis error |
