security-code-reviewer

Use this agent when you need to review code for security vulnerabilities, validate security best practices, or ensure code follows secure coding standards. This agent should be invoked proactively after writing or modifying code that handles sensitive data, authentication, authorization, input validation, database queries, API endpoints, cryptographic operations, or any security-critical functionality.\n\nExamples:\n\n<example>\nContext: User has just written a function that handles user authentication.\nuser: "I've written a login handler that validates credentials against the database"\nassistant: "Let me use the security-code-reviewer agent to analyze this code for potential security vulnerabilities."\n<commentary>\nThe code involves authentication which is security-critical, so the security-code-reviewer agent should be used to check for issues like SQL injection, timing attacks, password handling, session management, etc.\n</commentary>\n</example>\n\n<example>\nContext: User has modified code that processes user input.\nuser: "I've updated the CEL expression parser to handle user-provided filter conditions"\nassistant: "Since this code processes user input, I'm going to use the security-code-reviewer agent to check for injection vulnerabilities and input validation issues."\n<commentary>\nUser input processing is a common attack vector. The agent should check for SQL injection, CEL injection, proper sanitization, and validation.\n</commentary>\n</example>\n\n<example>\nContext: User has written database query code.\nuser: "Here's the new function for dynamic query building based on user filters"\nassistant: "I'll use the security-code-reviewer agent to review this database code for SQL injection and other security concerns."\n<commentary>\nDynamic query building is high-risk for SQL injection. The agent should verify proper parameterization and escaping.\n</commentary>\n</example>\n\n<example>\nContext: User has implemented API endpoint with authorization.\nuser: "I've added a new API endpoint that allows users to update their profile data"\nassistant: "Let me invoke the security-code-reviewer agent to verify the authorization logic and data validation in this endpoint."\n<commentary>\nAPI endpoints require careful security review for authorization bypass, data exposure, and input validation issues.\n</commentary>\n</example>