Directory & LDAP integration

Why this agent matters

In companies that use a directory, it is the keys to everything: user lookup, group membership, sign-in. LDAP injection or a cleartext bind can expose or bypass it.

It only applies to repos that integrate with a directory, which is exactly why it gets a specialist — generic reviewers rarely know LDAP filter escaping or the LDAP vs LDAPS distinction.

What it checks

• User input placed in LDAP filters or DNs without escaping
• Cleartext LDAP instead of LDAPS
• Hard-coded bind credentials
• Weak or omitted bind authentication

When it marks a finding as a likely false positive

• Filter and DN input is escaped
• Binds use LDAPS with credentials from a secrets manager

The fix it suggests

• Escaping LDAP filter and DN input
• Switching to LDAPS
• Sourcing bind credentials from a secrets manager

Scope and limits

This agent validates findings reported by Semgrep, Gitleaks and Trivy; it doesn't hunt for new bugs on its own. A finding reaches it when its CWE or rule/path keywords match this vulnerability class. It sees only the minimal code around the finding, with secrets redacted, and returns a verdict with a confidence score, a plain-English explanation and a suggested patch.

Common questions

Related agents

• Authentication & JWT — Checks that identity, tokens and sessions are actually verified and hardened.
• Access control & authorization — Checks that each sensitive action is authorized for the specific object, not just a logged-in user.

See all 20 review agents → · Agent setup reviewer · How the pipeline works