Use after writing or modifying code that handles untrusted input, authentication, authorization, secrets, file paths, database queries, shell commands, or outbound requests — before treating it as done. Makes the agent review its own change for common vulnerabilities instead of shipping them.
Use after writing or modifying code that handles untrusted input, authentication, authorization, secrets, file paths, database queries, shell commands, or outbound requests — before treating it as done. Makes the agent review its own change for common vulnerabilities instead of shipping them.