Start
Ship with Vinaya

Get security-reviewed

the same pull request, at the same time — a second, separate verdict comes out

Alongside the code review, a second check runs — the one built to catch what a correctness review does not.

What kind of tool
Another fresh agent session, run alongside the code review, not instead of it.
What you say to it
Ask it to check the same pull request for leaked secrets, unsafe configuration, and exposed surfaces.
What comes out
A second verdict — a clean pass, or its own list of findings. Both this and the code review have to be clean before anything merges.
What to look at in Studio
Same task row — merge stays blocked until both verdicts show clean.
Read the Security Reviewer role