---
title: "Scan every change for known mistakes · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/scan-every-change
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Scan every change for known mistakes

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

For AI agents: [llms.txt](https://agentwranglers.se/llms.txt) is a short guide that sends you to the rules your problem needs, and [rules.json](https://agentwranglers.se/playbook/adversarial-testing/rules.json) holds every rule of this playbook as JSON.

- Level: Recommended
- Chapter: [Rules of engagement](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement)
- Rule: Run a static security scanner on every change, and a dynamic scanner against staging before each release. Fail the build on new findings of high severity.
- How: A static scanner, such as Semgrep, CodeQL or Bandit, reads the source and flags known patterns, such as SQL joined from strings. Set one up as [Use Semgrep for static security scans](https://agentwranglers.se/playbook/stack/testing-and-code-quality/semgrep) does. A dynamic scanner, such as ZAP, sends attacks to a running copy. Neither finds broken access control or business logic, so scanners add to the agent's test and never replace it. Mark each false positive in the code with a reason, so it is reviewed once. Parsers of outside data also need [fuzzing](https://agentwranglers.se/playbook/testing/non-functional-tests/fuzz-parsers).
- Check: On a test branch, add a query joined from user input. The build fails and names the file and line. The last release has a dynamic scan report with no open finding of high severity.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```sh
semgrep scan --config p/owasp-top-ten --error
bandit -r src --severity-level high
```

## Sources

- [OWASP Source Code Analysis Tools](https://community.owasp.org/Source_Code_Analysis_Tools)

## Related rules

- [Use Semgrep for static security scans](https://agentwranglers.se/playbook/stack/testing-and-code-quality/semgrep) in Software choices
- [Fuzz every parser of untrusted input](https://agentwranglers.se/playbook/testing/non-functional-tests/fuzz-parsers) in Testing

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/scan-every-change">Agent Wranglers security testing playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Turn every fix into a check](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/fix-becomes-check)
- [Rules of engagement](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement)