Cloud security

Why this agent matters

A single public bucket or wildcard IAM policy can expose everything in an account, and these mistakes are made in code review, not at runtime.

The agent asks one question per resource — is access scoped to what it needs? — which turns a wall of IaC warnings into a short, ranked list.

What it checks

• Public storage buckets or blobs
• IAM policies with wildcard actions or resources
• Security groups or firewall rules open to 0.0.0.0/0
• Unencrypted storage and long-lived access keys in code

When it marks a finding as a likely false positive

• Public access is intentional, e.g. a static website bucket
• Ingress is restricted to known ranges

The fix it suggests

• Least-privilege IAM
• Blocking public access
• Short-lived credentials via roles

Scope and limits

This agent validates findings reported by Semgrep, Gitleaks and Trivy; it doesn't hunt for new bugs on its own. A finding reaches it when its CWE or rule/path keywords match this vulnerability class. It sees only the minimal code around the finding, with secrets redacted, and returns a verdict with a confidence score, a plain-English explanation and a suggested patch.

Common questions

Related agents

• Infrastructure & IaC — Reviews Terraform, Helm, Ansible and server config for insecure defaults and exposure.
• Container & Kubernetes — Checks Dockerfiles and Kubernetes manifests for root, privileged and host-level access.
• CI/CD pipeline — Checks pipelines for leaked secrets, untrusted code execution and over-broad tokens.

See all 20 review agents → · Agent setup reviewer · How the pipeline works