Review security findings
Read the evidence, scope, and remediation behind a security report.
The Security agent investigates security concerns in the available project context and records findings. Give it a bounded question, affected repositories, and the evidence or behavior that prompted the review.
Define the review
Open the Security workspace and describe the scope. For example, ask it to inspect authorization on workspace file downloads, including how membership is checked and how URLs expire.
State what evidence you expect: reachable code paths, required attacker access, affected resources, and a reproduction or focused check when feasible. Do not assume the role name implies every repository, dependency, or production endpoint was scanned.
Assess a finding
Read the linked report and distinguish the claimed impact from demonstrated behavior. Check the affected version or path, the conditions needed to reach it, and the confidence or unresolved questions.
A convincing finding explains who can do what, against which resource, through which path. If the evidence is incomplete, ask for validation in an authorized environment before treating a hypothesis as an established incident.
Plan and verify remediation
Ask for a focused fix that preserves legitimate behavior. Link the remediation task or session to the report and review both the change and its verification. A closed report or completed turn does not by itself demonstrate that the serving system contains the fix.
Use your team's security and release process for acceptance and rollout. Reports do not provide a certification, compliance guarantee, or a promise of exhaustive coverage.
See review changes, task progress, and external tools for supporting workflows.