Factory rolls out automated security review in Droid

Factory is rolling out automated security review in Droid, which runs a STRIDE-based security review alongside standard code review on every non-draft PR and posts findings with severity, a CWE reference, an explanation and a suggested fix as inline comments on the diff. The company says Droid's security review has been run across production codebases and surfaced findings that went through responsible disclosure, including CVE-2026-42876 in external-secrets and workos/workos-node#1578. Droid builds a lightweight threat model of the changed surface, scans for vulnerabilities such as OWASP Top 10 and OWASP LLM Top 10 issues, then validates each candidate finding against the diff to filter false positives before posting one deduplicated summary per PR.