CODING AGENT WORKFLOW · PRACTICAL GUIDE

Diff Risk Pre-Review

Highlight possible hard-coded secrets, destructive SQL or shell, raw HTML sinks, and authorization changes before a deeper review.

THE PROBLEM

Sending every patch to an expensive reasoning model can be slow. A deterministic first pass can identify obvious categories for the coding agent to inspect with more care.

HOW THIS TOOL WORKS

diff_risk_review runs a small set of fast patterns and reports the categories that matched. It does not modify a patch, block deployment, or claim that a clean result is safe.

TRY IT

node dist/cli.js review-diff --file change.patch

LIMITS

Patterns miss many vulnerabilities and can raise false positives. Treat this as triage only; run language-specific linters, tests, static analysis, and a human security review when needed.