Segurança

Authentication and authorization patterns — JWT, OAuth 2.0, sessions, RBAC/ABAC, password security, MFA, and vulnerability prevention. Use when implementing login flows, protecting routes, managing tokens, or auditing auth security.

Reviews existing code and pull requests using multi-agent swarm analysis covering security, performance, style, test coverage, and documentation quality. Extracts and prioritizes PR comments, performs security audits, and generates actionable fix plans with file:line references. Use when the user asks to review code, review a PR, audit code for security, assess code quality, analyze pull request c

Use when running the full audit sweep on a scope — runs the focused audit dimensions (necessity, structure, patterns, correctness, error handling, logs, perf, security, tests, complexity, comments) as a parallel-worktree workflow that integrates in dependency order. Triggers on "audit", "full audit", "audit everything".

Reviews LLM application prompts and input handling for direct and indirect prompt injection vulnerabilities, then writes defensive scaffolding.

Identifies and prioritizes technical debt in a codebase with an effort/impact matrix.

Assess mobile applications with static and dynamic analysis aligned to OWASP MASTG and MASVS.

Use when auditing and fixing performance hot paths in a scope — N+1 queries, overfetching, wasted recomputation, blocking hot paths, unbounded growth. Triggers on "audit performance", "fix slow paths", "check for N+1", "performance review".

Use when auditing and fixing security in a scope — injection (SQL, shell, template), auth/authz gaps, secrets in code or logs, weak crypto, missing validation at trust boundaries, XSS, SSRF, path traversal. Triggers on "audit security", "security review", "fix vulnerabilities", "OWASP check".

Test APIs against OWASP API Security Top 10 including discovery, auth abuse, and protocol-specific checks.

Map application security findings to OWASP Top 10 categories and generate remediation checklists. Use for normalized AppSec review outputs and category-level prioritization.

Audits an AI application for unnecessary token spend and recommends prompt caching, model routing, and token reduction techniques to cut costs.

Use when the user is finishing a track and wants to check it's ready to send to a mastering engineer or for self-mastering. Audits headroom, peak levels, mono compatibility, frequency balance, LUFS. Examples - "is this ready to master?", "audit my mix before export", "check my levels".