Securecoder Setup
One-time team configuration wizard for securecoder. Asks 10 questions and writes `.securecoder/config.json` to the project root — overlay frameworks, severity floor, default fix scope, git push strategy, scan-output gitignore policy, language overrides, advanced source/tool pins, and framework-fit settings. Run once when a team adopts securecoder; re-run any time to change preferences.
Securecoder Review
Fast diff-scoped security review of staged or uncommitted changes. Pre-commit gate. Runs SAST + scoped LLM compliance on the diff only — cost proportional to change size, not repo size. Optional pre-commit hook installation for SAST-only blocking-mode.
Securecoder Build
Activate a persistent secure-build mode that supervises the host agent for the rest of the session. Emits an ASVS-grounded policy block into chat — the agent then plans every code change against applicable controls and self-checks every output before declaring done. Optional minimal bootstrap for empty repos.
Securecoder Suppress
Mark findings as false positives. Writes structured entries to .securecoder/suppressions.json — the source of truth that /securecoder-scan honors when stamping status="suppressed" on matching findings. Eight modes for add / import / show / show <id> / show stale / show expired / remove / expire.
Securecoder Update
Check whether the installed securecoder is current. Reports the installed version + the latest release on GitHub + days since release + release notes URL + the exact install command to upgrade. Read-only — never modifies anything; upgrade is always an explicit user action.
Securecoder Advise
Interactive Q&A grounded in cached OWASP framework markdown (ASVS, MASVS, Cheatsheets, Proactive Controls) and the latest /securecoder-scan findings. Verbatim citations before any interpretation. Read-only — never modifies code.
Securecoder Secure
Easy-button end-to-end secure pipeline. Runs SAST scan → fix → ASVS compliance scan → fix → unified report, all with one up-front cost approval and a 50%-overrun mid-run gate so blown estimates don't run away. Requires /securecoder-scan and /securecoder-fix installed alongside.
Securecoder Fix
Remediate findings from a previous /securecoder-scan run. Pre-flight (clean-tree, branch, backup) + per-fix loop (LLM SEARCH/REPLACE → syntax check → re-scan → commit) + automatic rollback on any verification failure. Supports severity multi-select, by-finding-ID targeting, interactive one-by-one mode, and a --restore action to roll back a previous fix run.
Securecoder Scan
Audit a codebase for vulnerabilities and OWASP compliance issues. Runs four SAST tools — Semgrep, Bandit, Gitleaks, OSV-scanner — and an LLM-driven compliance pass against OWASP ASVS v5 / MASVS / Proactive Controls. Emits findings in the unified securecoder schema, with markdown + HTML reports and run-history under .securecoder/runs/<id>/.