OWASP-Aware AI Code Review: How to Catch SQL Injection Before Merge

Why generic AI reviewers miss security bugs

Generic LLM reviewers (CodeRabbit, GitHub Copilot review, default Agentopias by CynetIQ reviewer) are tuned to be helpful: they comment on style, naming, edge cases, and obvious bugs. They are not tuned to be paranoid — and security review needs paranoia.

A typical generic reviewer comment on a SQL string concat:

> "Consider using parameterized queries here for clarity."

A paranoid security reviewer comment on the same line:

> "SQL injection — CRITICAL. This query string is built from request input via f-string. The downstream call hits a writeable Postgres connection. An attacker can drop tables, exfiltrate data, or escalate to OS-level command execution via COPY ... TO PROGRAM. Fix: replace f-string with text(':order_id') and pass {'order_id': order_id} to .execute(). Verify no other call site builds queries this way."

The first comment is technically right. The second is actionable, severity-ranked, and threat-modeled. That's the difference an OWASP-aware reviewer makes.

What an OWASP-aware reviewer does

The security_developer reviewer agent in Agentopias by CynetIQ runs a system prompt that makes it:

• Treat every input as malicious by default.
• Trace the data flow: where does this string come from, where does it go, who can reach it?
• Map findings to the OWASP Top 10 explicitly: A03 Injection, A01 Broken Access Control, A07 Authentication Failures, A10 SSRF, etc.
• Output a threat model, not just a fix.
• Score severity on a fixed scale: critical / high / medium / low / clean.

The OWASP Top 10 cheat sheet

The reviewer prompt explicitly checks for:

Risk	What the reviewer looks for
A01 Broken Access Control	Missing authorization, IDOR, role checks bypassable by request input
A02 Cryptographic Failures	Hardcoded keys, weak algorithms (MD5/SHA1 for passwords), missing encryption-in-transit
A03 Injection	SQL, NoSQL, LDAP, OS command, XPath, SSI; any string concat with user input
A04 Insecure Design	Missing rate limiting, predictable IDs, unscoped resource access
A05 Security Misconfiguration	CORS *, debug = True, default creds, exposed admin paths
A06 Vulnerable Components	New deps without pinning, removed pin on a known-CVE package
A07 Auth Failures	Brute-force-able login, plaintext token storage, JWT alg: none
A08 Data Integrity	Insecure deserialization (pickle, yaml.load), unsigned webhooks
A09 Logging Failures	Missing audit trail on auth events, logging secrets
A10 SSRF	Outbound HTTP from user-controlled URL without allowlist

Setting it up in Agentopias by CynetIQ

security_developer ships pre-built. To use it on every PR generated for a specific source:

Go to /dashboard/integrations/rules.

Match the source you want covered (e.g. all Sentry imports, or all Jira tickets in the SEC project).

Set the action: Preferred Agent Role = security_developer.

Now every imported task in that source automatically routes through the OWASP reviewer when it reaches the review stage. You can also click 🔎 Review on any task and pick security_developer manually.

Sample output

``

Summary

The patch removes the missing-nullcheck but introduces a SQL injection on /api/orders/refund.

Findings

order_service.py:88 — SQL injection (CRITICAL). String concat builds WHERE clause from request param.

Fix: parameterize. Verify no sister functions do the same. Consider an allowlist on order_id format.

routes/orders.py:42 — Missing auth (HIGH). /orders/{id}/refund has no Depends(get_current_user).

order_service.py:103 — Logging request body unconditionally (MEDIUM). May log card numbers.

Severity

critical

Score

24

`

Audit history

Every review the security_developer agent has done is on the reviews page — filterable by severity, agent, repo, time range. Per-agent history banner shows severity distribution and average score, which is what you want at QBR time when leadership asks "how much did our security reviewer catch this quarter."

Why not just use a SAST tool?

SAST and AI review are complementary. SAST tools (Semgrep, Snyk Code, CodeQL) excel at pattern matching — they catch every exec(input())` even at 3am. AI reviewers excel at semantic reasoning — they understand that the input came from a request param three call sites away. Run both. SAST blocks merge on known patterns; AI flags risky design before it ships.

Related reading

• AI Code Review landing page
• Custom reviewer agent setup tutorial
• From Sentry alert to merged PR in 12 minutes