security-sweep

# Security Sweep Scan the codebase for dangerous constructs, then use the graph to answer the question a flat scanner cannot: **can untrusted input actually reach this?** A medium-severity finding in a request handler outranks a critical one in dead code, and only the call graph can tell them apart. **Command surface:** run the local CLI through the coding harness shell. Examples use the installed `better-code-review-graph` command; from a source checkout, prefix it with `uv run`. No MCP mapping is required. ## Steps 1. **Make the graph current** with `better-code-review-graph graph build --base HEAD --repo-root "<path>"`. Findings are attached to graph nodes, so anything unindexed is unscanned. 2. **Read the active ruleset** with `better-code-review-graph security rule_list --engine heuristic` before scanning, and check which languages each rule declares. This determines what a clean result is worth -- see Coverage Limits below. 3. **Run the Tier 1 scan**: `better-code-review-graph security scan --engine heuristic --repo-root "<path>"`. It returns `total`, `by_severity`, `by_rule`, `tags_by_node`, and `suppressed_count`. Tier 1 is regex matching over the source of function, class, and method nodes -- fast, no external tool, no data-flow analysis. 4. **Run Tier 2 when it is available**: `better-code-review-graph security scan --engine semgrep --repo-root "<path>"`. Semgrep is an opt-in extra and is not installed by default. - When the CLI is missing the command retu...