TL;DR
I wired a dedicated security-reviewer agent into my pull request flow and let it run on ~300 PRs over four months. It caught 11 real vulnerabilities my linters missed — and cried wolf a lot until I added a second agent whose only job was to disprove the first one. Here's the setup, the checklist, and the honest scorecard.
The Problem
I run a fully autonomous implementation system: agents pick up work, write code, and open pull requests largely without me. That works great for throughput and terribly for my peace of mind.
The specific fear wasn't "the agent writes bad code." Bad code shows up in tests. The fear was the agent writes code that works perfectly and is also a security hole. A happy-path integration test doesn't care that you interpolated a user-controlled string into a shell command. It passes. It ships.
