> Security gets its own automated review too. ... You either fix it or close the thread with a short reason, which is how you clear a false positive.

I hope this is only for low-risk false positives. Dismissing a critical finding as a false positive should still involve AppSec.

You could improve revert rates while simultaneously introducing more security vulnerabilities.

And the linked "claude-code-security-review" explicitly states in the README

> This action is not hardened against prompt injection attacks

That's a significant limitation for an AI security review control, no?