Earlier quoted context omitted.
Ensure you check every PR with opens4.8 or fable - they catch every security issue upfront.
This isn't going to work because the LLM doesn't have enough context. Many security issues involve a failure mode which cuts across multiple parts of the code. A PR which seems perfectly valid on its own may be the missing piece which opens up a vulnerability. Each component may be fine on its own, but brought together, the system is vulnerable. Think of a machine with interlocking gears; each gear may itself be perf…
why do you think it's not possible to have full context of codebase? modern harnesses excel at finding all the right codepaths, even in a large codebase.