Differential Review

Differential Review

Security-focused code review that adapts depth to codebase size and change risk. Goes beyond style -- finds vulnerabilities, logic errors, and blast radius.

Review Depth Modes

DEEP (Small codebase, < 5K lines changed)

• Line-by-line analysis of every changed file
• Full control flow tracing through changed paths
• Cross-reference every function call to its definition
• Check all error paths and edge cases

FOCUSED (Medium codebase, 5K-50K lines)

• Prioritize files touching auth, crypto, input parsing, state mutation
• Trace data flow from inputs to outputs through changed code
• Skip cosmetic changes (formatting, comments, renames)
• Deep-dive only on security-sensitive paths

SURGICAL (Large codebase, > 50K lines)

• Review only the diff, not surrounding code
• Focus exclusively on: new attack surface, removed security controls, changed trust boundaries
• Flag anything that needs a separate deep review

Review Process

Phase 1: Blast Radius Assessment

Before reading any code:

# What changed?
git diff --stat <base>...<head>

# How much changed?
git diff --shortstat <base>...<head>

# Which files are security-sensitive?
git diff --name-only <base>...<head> | grep -iE '(auth|crypto|token|secret|permission|middleware|validator|sanitiz)'

Classify the change: