Security
A security review that checks every category, not the ones it remembered
A free-form agent asked to review security will find injection, mention authentication, and stop when it feels thorough. This package removes the feeling. It runs the full OWASP Top 10 (2021) assessment — all ten categories, every item in each — and then builds a STRIDE threat model from the codebase itself, starting with a survey of every entry point and trust boundary before a single threat is enumerated.
The STRIDE model is the part that cannot be done by skimming. The engine walks the agent through the stack, the entry points, the route registrations, the deployment configuration and the external clients in five reviewed passes, draws the data-flow diagram, and only then analyzes each element for the threat categories that apply to it.
Security Review
Free
Pro and up · included with your license
Teams who need a security review they can hand to a reviewer and defend line by line, and anyone shipping to a customer whose procurement asks what threat model was done.
What runs
The workflows inside
OWASP Top 10 Assessment
Ten category workflows run as child instances — Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable and Outdated Components, Identification and Authentication Failures, Software and Data Integrity Failures, Security Logging and Monitoring Failures, Server-Side Request Forgery — each checking every item in its own step, then a compile step that dedupes, ranks and verifies.
STRIDE Attack Surface Analysis
Builds the system model — external entities, processes, data stores, data flows, trust boundaries and a Mermaid data-flow diagram — self-checks it until it passes, then analyzes every element for its applicable STRIDE categories with severity and category-matched mitigations, and compiles the threat report.
STRIDE Survey Codebase
The five reviewed survey passes the model is built from: stack and manifests, entry points, route and handler registrations, deployment and configuration files, external SDK and client usage. Each pass is gated by a review node.
How a run goes
Step by step, in the order the engine enforces
- 1
Survey before modeling
The engine will not let the agent enumerate threats until the survey passes: five passes over the codebase, each reviewed, assembled into a system model with trust boundaries marked.
- 2
One element, one analysis
Each element of the data-flow diagram is analyzed in its own step for the STRIDE categories that apply to its type, with concrete threats, severity and a mitigation each. Approved threats are appended to a log on disk.
- 3
Ten OWASP categories, every item
In parallel, each OWASP category runs as its own child workflow, checking every item and appending reviewed findings to the shared log.
- 4
Two reports, both verified
Each compile step dedupes, ranks, verifies that every response is a real mitigation, and writes its report behind a final review.
What you get
At the end of a run
- ✓An OWASP Top 10 report with findings per category, ranked and verified
- ✓A STRIDE attack-surface report with the data-flow diagram, trust boundaries and a threat per element with its mitigation
- ✓Both findings logs, every entry citing the code it refers to
Read next
Related packages
- Code Quality →
Run a full ISO/IEC 5055 and Clean Code assessment of any codebase with your coding agent, every check its own verified step. Free with every CodyCody plan.
- Boy Scout Coding →
A code change by your coding agent: scoped, designed, approved at two human gates, reviewed from three angles, covered by tests — and the code left cleaner.