Repository navigation
Add whole-app security review mode and opt-in security scanners - #1960
Closed
remigiusz-antczak wants to merge 2 commits into
Closed
remigiusz-antczak wants to merge 2 commits into
remigiusz-antczak wants to merge 2 commits into
Conversation
Adds references/security-review-mode.md, a focused procedure for security-only reviews, routed from SKILL.md with a "read this when" trigger. Adds an eval case for it and logs the verified sources in docs/standards-index.md. Generated rows (size budgets, INDEX.md) are rebuilt at land time, not committed here. security-review-mode.md links appsec-supply.md and dependency-currency-and-upgrades.md instead of restating them. Tests: 13/13 (scripts/test-review-checks-security.sh), 16/16 (scripts/test-review-checks.sh), 6/6 (scripts/test-prepush-ci-parity.sh); gates routing, size, enumeration, mustload, rules, privacy ok; scripts/test-ci-gates.sh not completed in sandbox (dcr-gates opt-in cases fail on network) review_checks.sh: optional gitleaks, osv-scanner and semgrep scanners (run only when installed, timeboxed; semgrep needs a local REVIEW_SEMGREP_CONFIG, never --config auto). New scripts/test-review-checks-security.sh uses stub binaries on PATH. No-Mechanism-Reason: review_checks.sh is a script and its new test is the mechanism; the SKILL.md-adjacent reference edit rides the eval case added in this commit. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014QNFFPWVcPUbeuvwM5fk2Z
This was referenced Oct 23, 2026
Collaborator
Author
|
Superseded by #1970 (merged). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
references/security-review-mode.md, routed from SKILL.md, for whole-app security audits. It orchestrates the existing security references and adds six gap checks: inventory-first attack chaining, a host-platform breach and secret-rotation runbook, CI OIDC trust, install-script worm checks, agent and MCP least privilege, and dated runtime and framework advisory currency.review_checks.shgains three optional scanners that run only on changed files. gitleaks redacts secrets. osv-scanner runs only when a lockfile changed andREVIEW_OSV=1is set, because it queries the OSV API. semgrep runs only with a localREVIEW_SEMGREP_CONFIGpath and never uses--config auto.Tests: 13/13 in scripts/test-review-checks-security.sh and 16/16 in scripts/test-review-checks.sh. The sources are logged in docs/standards-index.md with fetch dates. An independent review found one 🔴: osv-scanner ran without an opt-in. It is fixed in this commit.
🤖 Generated with Claude Code
https://claude.ai/code/session_014QNFFPWVcPUbeuvwM5fk2Z