What it does
Audits a mobile change for the security defects that pass a code review and a green build: a credential committed in a test fixture, a handler that authenticates without authorizing, a token written to an analytics event, a dependency added with a name one letter away from a popular package. It treats a diff as adversarial until shown otherwise, and it is deliberately biased toward flagging. A false positive costs a minute; a missed credential costs a rotation and everything that used it in between. Where it cannot tell a real key from a placeholder, it says so and flags it anyway. It knows the mobile-specific mistakes. Anything shipped inside an app binary is readable by anyone who downloads it, so a secret in client code is not hidden by obfuscation — it is published. It checks where sensitive values are stored on-device, what leaves in logs and third-party SDK calls, whether deep links and redirect handling accept destinations from outside the app, and whether transport security has been weakened for a debugging session and left that way. It reports and never fixes, and it never claims to have scanned anything it was not shown. Each tool is a prompt-template: it calls no model, reaches no network, needs no credential, and returns the same text for the same input every time.
Finds the security defects that pass a code review and a green build.
Example prompts
- Audit this diff before I merge it.
- We're storing the session token on the device — is this the right place for it?
- Check this Lambda handler for auth and validation gaps.
