find-bugs

Get the full diff against the default branch, map each changed file's inputs, queries, and auth checks, then work through a security checklist covering injection, XSS, CSRF, and access control. Verify each finding against surrounding code before reporting.

Run git diff against the default branch to see all changes, then inspect every modified file for logic errors, race conditions, and unhandled edge cases. Confirm each suspected issue is not already handled elsewhere or covered by existing tests.

A thorough checklist covers injection, XSS, authentication, authorization/IDOR, CSRF, race conditions, session handling, cryptography, information disclosure, denial of service, and business logic flaws. Each item should be checked for every changed file.

No, the review only reports findings and does not make any changes to the code. Each issue is reported with file and line, severity, evidence, and a suggested fix, leaving remediation decisions to you.

The review only covers changes on the current branch relative to the default branch, so pre-existing issues elsewhere may be missed. Some findings may not be fully verifiable without runtime context, and those gaps are explicitly listed in the audit.