security-review (Sentry)
- Workflow
- Security
Hunts only for exploitable security holes — injection, XSS, broken auth, weak crypto — and deliberately stays quiet unless it can point at attacker-controlled input reaching a vulnerable pattern. It reports high-confidence findings only, so a clean run is not proof of safety.
A situation it fits
Ship is Friday. You want to know whether anything in this quarter of work is genuinely exploitable, and you do not want to wade through naming opinions to find out.
2 scenarios in the bank answer to security-review (Sentry). The rest are in the game.
Skills it gets confused with
These share a family with security-review (Sentry), which is another way of saying they are the ones you might reach for by mistake.
- code-review (Matt Pocock)Reviews a diff since a fixed point along two axes at once: whether the code follows the repo's own documented standards, and whether it does what the originating ticket actually asked for. The second axis is the unusual one — it catches work that is clean but off-brief.
- code-reviewer (CodeRabbit)Hands the diff to a commercial review engine and reports what it finds: vulnerabilities, code smells, convention breaches, performance traps and likely bugs. You are buying somebody else's trained reviewer rather than running your own checklist.
- code-reviewer (Jeff Allan)One sweep across everything at once: correctness, security, N+1 queries, naming, architecture and test coverage, returned as a single prioritised report. Breadth in one pass, where the specialised reviewers each go deep on one axis.
- dependency-updater (softaworks)Works over a project's dependency manifest — detecting the language, applying the safe minor and patch bumps on its own, pausing on major versions, and running that ecosystem's vulnerability audit (npm audit, pip-audit, govulncheck, cargo audit and the like) to flag known-vulnerable packages. It secures the supply chain around your code, not the code itself: it does not scan your own source for bugs, write detection rules, or reason about a design's threats.
- secure-error-handling (harperaa)A secure-coding pattern for the error path: return generic, environment-aware messages to users while logging the detail server-side, so a stack trace, database error, or file path never hands an attacker a map of your system. It shapes how failures are surfaced — not a scanner that finds the leaks for you, and narrower than a full security review: it does not cover auth, input validation, or the other vulnerability classes, only how errors are reported.
- security-review (affaan-m/ecc)Helps developers implement secure features by listing concrete checks and recommended patterns for authentication, input handling, secret management, API endpoints, and payment or sensitive flows. Unlike similarly named tools that scan code or produce vulnerability audits, this one focuses on design-time guidance and implementation checklists — it does not run automated SAST, assign severity scores, or perform penetration-style audits of diffs.
Knowing what security-review (Sentry) does is the easy half. Telling it apart from the others under time pressure is the game.
Today's sessionsecurity-review (Sentry) is part of getsentry/skills. Licence: Apache-2.0. The description above was written for this game, not taken from the skill.