/review vs /security-review
/review looks for correctness bugs in a diff, PR, branch or path; /security-review checks your branch's changes for security vulnerabilities.
Reviews the current diff, a pull request number, branch, or specified path. It accepts effort levels and flags, reusing the last level if none is provided. This command is an alias for /code-review.
Use it when
Before you push, to catch logic bugs and cleanup opportunities. It is an alias for /code-review and accepts effort levels.
Analyzes changes on your current branch for security vulnerabilities. It reviews the diff between your branch and the origin's default branch, identifying risks such as injection, authentication issues, and data exposure.
Use it when
When the change touches input handling, auth or data access. It reviews the diff against the default branch for risks like injection, auth issues and data exposure.
More comparisons
Never mix them up again
/cards has a scenario quiz that asks which command fits the situation.