Automated Security Review

Factory's automated security review brings potential vulnerabilities into the code-change discussion. The company says Droid examines non-draft pull requests, builds a lightweight threat model of the changed code and checks each candidate finding against the diff to filter false positives before posting. Findings appear as inline comments with severity, a CWE reference (a standard identifier for a weakness type), an explanation and a suggested fix. That gives developers a specific issue to investigate while reviewing a change. The workflow also supports on-demand audits. Factory cites responsibly disclosed findings from audits of production code, but the announcement supplies no detection-rate or false-alarm measurement establishing how reliably the reviewer works. Security-review announcement