devflow:build:security-review

Security Review

I'll perform a comprehensive security analysis.

---

Step 1: Parse Arguments & Determine Scope

Parse $ARGUMENTS for:

• --show-dismissed flag: if present, include previously dismissed issues in report
• ISSUE_KEY: if provided, scope to branch changes for that issue

Load backend configuration from devflow-config.md to determine issue tracker for ticket creation.

If ISSUE_KEY provided: Scope is branch changes — find files modified since branching from the base branch.

If no ISSUE_KEY: Ask user what to scan:

1. Full repository
2. Current branch changes
3. Specific files
4. Specific directory

Display the files that will be analyzed and their count.

---

Step 2: Invoke Security Scanner Agent

Use the Task tool with subagent_type="security-scanner" to analyze the scoped files.

Provide the agent with:

• Scan context (issue key or scope description)
• List of files to analyze
• Request comprehensive analysis across all relevant vulnerability categories for the languages present

The agent autonomously reads files, identifies vulnerabilities, and provides remediation guidance.

---

Step 3: Present Findings

Display the security assessment summary:

• Scope and file count
• Findings by severity: CRITICAL, HIGH, MEDIUM, LOW
• Detailed findings from agent report

If no findings: Skip to Next Steps.

---

Step 4: Triage Security Findings

Before triage:

• If .devflow/security/[ISSUE_KEY]-dismissed.json exists, load dismissed issues
• If --show-dismissed: display all dismissed issues with reasons, then show current findings
• If not --show-dismissed (default): filter dismissed issues out of current findings

For each finding, present:

• File, line number, severity
• Current code snippet
• Issue description
• Recommended fix

Ask user for each finding — one at a time:

1. "fix" — Apply the recommended fix now
2. "dismiss [reason]" — Mark as false positive, accepted risk, or not applicable
3. "ticket" — Create issue to track for later
4. "manual" — Developer will fix, skip for now
5. "skip" — Defer to next security review

Actions:

• fix: Apply the fix with Edit tool. Track as "applied."
• dismiss: Save to .devflow/security/[ISSUE_KEY]-dismissed.json with reason and date. Future reviews skip these automatically.
• ticket: Use build-ops to create issue in configured backend (Jira/GitLab). Map severity to priority. Display ticket ID.
  • If no issue tracker configured, display finding details for manual tracking.
• manual/skip: Track for summary. These reappear in next review.

Repeat for all findings.

---

Triage Summary

After all findings triaged, show:

• Applied fixes: count and list
• Dismissed: count, files, and reasons
• Created tickets: count with ticket IDs
• Manual/Deferred: count (note: will reappear in next review)

If fixes were applied, commit them referencing the issue key.

If dismissals were recorded, note the dismissed issues file path and how to review them with --show-dismissed.

---

Next Steps

If ISSUE_KEY was provided:

• If unaddressed CRITICAL/HIGH findings remain: warn before proceeding
• Otherwise: ready for /devflow:build:complete-issue [ISSUE_KEY]

If general scan: Review triage summary. Re-scan after manual fixes if needed.