# Security Code Review: Findings Before the Release

Source: https://maito.app/workflows/check-a-change-for-security-problems

Maito reads a branch and its callers for injection, leaked secrets and missing permission checks, then reports each finding with the line and a suggested fix.

Look at a change for injection, leaked secrets and missing permission checks.

[Engineering](https://maito.app/workflows/team/engineering) · [Software](https://maito.app/workflows/industry/software) · When you ask · Updated October 19, 2026

Works with

-   Slack
-   Email

## How do you run a security code review with AI?

To run a security code review with AI, mention Maito in Slack with the branch name. It reads the changed files and their callers, checks for injection, leaked secrets and missing permission checks, then replies with findings ranked by severity, the line for each, and a suggested patch you can review.

## How it's done today

Security review happens only for big releases.

## What Maito does

1.  Read the change
2.  Check for common security mistakes
3.  Report what's risky and how to fix it

## Example

**Alex** (1:12 PM):

security-review the new file upload endpoint on branch feat/uploads before Thursday's release.

**Maito** (1:31 PM):

One high, one medium. Everything else in the diff (auth check, size limit, signed URLs) looks right.

**High:** routes/uploads.ts line 37 trusts the Content-Type header. An .html file sent as image/png is stored and served from app.northstar.example, so a script inside it runs with a logged-in user's session.

**Medium:** the original filename goes into the storage key unchanged, so a name like ../../avatars/ceo.png can overwrite another file.

Suggested fix: check the real file type from its first bytes, store under a generated ID, serve uploads from a separate domain. Attached: uploads-fix.patch (not applied).

I read the changed files and their callers only. Worth a look from your security lead before release.

Want me to apply the patch on a branch and open a PR?

## How to set it up

When you ask Check a change for security problems

Set up

Nothing to set up. Ask in Slack or by email whenever you need it.

## What it won't do

It reads the diff and its callers, not the whole system, so problems that depend on infrastructure or other services can go unseen. A person on your team still signs off on the release.

## Questions

### Does it change my code?

Only if you ask. It attaches a suggested patch first. Applying it on a branch and opening a pull request happens after you say yes.

### How much of the codebase does it read?

The changed files and the code that calls them. It tells you that scope in the reply, so you know what was not checked.

### Can it replace our security review?

No. It catches common problems early and gives your security lead a shorter list to look at before release.

## More engineering workflows

-   [Turn a ticket into a tested pull request Hand over a well-scoped ticket and get back a pull request with tests. Engineering · When you ask Works with Linear, Jira.](https://maito.app/workflows/turn-a-ticket-into-a-tested-pull-request)
-   [Review a teammate's pull request Get a first review that catches bugs and missed cases before a person looks. Engineering · When something happens Works with Slack, Email.](https://maito.app/workflows/review-a-teammates-pull-request)
-   [Write the changelog Twice a week, turn merged pull requests into a changelog people can read. Engineering · On a schedule Works with Slack, Email.](https://maito.app/workflows/write-the-changelog)
-   [Nudge stale pull requests Pull requests waiting too long get a polite reminder to the right reviewer. Engineering · On a schedule Works with Slack, Email.](https://maito.app/workflows/nudge-stale-pull-requests)
-   [File a bug from a Slack thread When a bug comes up in chat, mention Maito and it gets filed once, with details and no duplicates. Engineering · When you ask Works with Linear, Jira.](https://maito.app/workflows/file-a-bug-from-a-slack-thread)
-   [Draft the incident postmortem Turn the incident channel and logs into a postmortem draft. Engineering · When you ask Works with Datadog, Sentry.](https://maito.app/workflows/draft-the-incident-postmortem)

[See all workflows](https://maito.app/workflows)

## Put your AI teammate to work.

Set it up in minutes. Start with this one, and let it earn the next one.

[Put Maito to work](https://maito.app/login?returnTo=%2Fworkflows%2Fcheck-a-change-for-security-problems)[Book a demo](mailto:support@maito.app?subject=Maito%20demo)