Security Review

Security Review is a GitHub Awesome Copilot skill for reasoning about application-security risks across an entire codebase. Instead of limiting the review to simple pattern matching, it follows data flows, examines dependencies, secrets, authentication, access control, cryptography and business-logic risks, then proposes patches for human review.

• Developers reviewing AI-generated code for security
• Application-security and DevSecOps workflows
• Teams checking authentication or authorization logic
• Projects needing a broad codebase vulnerability review

• Check code for injection flaws such as SQL injection or XSS
• Find exposed secrets and risky dependencies
• Trace user-controlled input across files to sensitive sinks
• Review authentication, authorization and business-logic weaknesses

The workflow resolves scope and languages, audits dependencies, scans for exposed secrets, performs a deeper vulnerability review, traces data flow across files and then self-verifies findings to reduce false positives. Findings are assigned severity and high-risk issues can include proposed patches that must be reviewed before application.

• Covers multiple vulnerability classes in one workflow
• Uses cross-file reasoning rather than only local patterns
• Adds a self-verification pass to challenge findings
• Keeps patch application under human control

• This is an AI-assisted review, not a replacement for professional penetration testing or specialist tooling
• Finding quality depends on repository access and context
• Dependency and vulnerability information can change and should be checked against current authoritative sources