[Security]: AI-Assisted Security Review (Tooling + LLM)

[DenizAltunkapan]

Run a structured security review using automated tools and LLM-based analysis to identify potential vulnerabilities and document them.

Scope

• Static code analysis
• Dependency vulnerabilities
• Authentication / authorization flows
• Input validation and data handling
• Basic runtime / API checks

Guidelines

• Only create issues for:
  • confirmed vulnerabilities
  • or clearly actionable risks
• Avoid duplicates (check existing issues first)
• Group minor findings into a single issue
• Tag findings with severity and confidence if possible

Tools (suggested)

• Semgrep (static analysis)
• Dependabot / Snyk (dependencies)
• Trivy (container + dependencies)
• OWASP ZAP (runtime / API)
• LLM-based review (Claude / OpenAI) for logic & architecture

Outcome

• Structured list of findings
• Minimal, high-quality follow-up issues
• Improved documentation of known risks

Note

This is a mid-development review, not a final security audit.