# Security review

Use your coding agent and the Zrelay API for a bounded review, with evidence and human verification for each finding.

Source: https://zrelay.net/docs/security-review/

## Set the scope

Identify the repository, revision, components and permitted checks. Supply only the code needed for the question. Remove secrets and personal data, and review applicable data-processing terms before sending source code.

This is an example client workflow. Zrelay does not expose a security-review API endpoint or certify the outcome of an audit.

## Review in stages

First map entry points and trust boundaries. Then trace concrete inputs to sensitive operations. For each candidate issue, request the relevant code path, preconditions and a bounded verification that fits your authorized scope.

## Verify findings

Check claims against the actual revision. Separate confirmed problems from hypotheses. Record reproduction steps, impact and a minimal correction. Test corrections locally; do not let an agent run attacks or make production changes without authorization.

## Connect your tools

Start with [Coding agents](https://zrelay.net/docs/md/agents/coding-agents.md) or [Build an agent](https://zrelay.net/docs/md/agents/build.md). Follow [privacy information](https://zrelay.net/legal-privacy.html) and your organization’s source-handling policy.