Repository navigation
Gate whole-app security findings on a cited guard check - #2296
Merged
Merged
Conversation
A bench of whole-app security audits showed the reviewer filing env-gated dev bypasses, consoles behind auth, local-only paths, same-bearer JWT claim mismatches and platform-gated routes as findings. Step 5 of whole-app security mode now links appsec-verify.md section 1 and adds only the delta: five guard classes, a cited guard file:line or 'no guard found at <paths>', and an env rule that drops a finding only when the production value is read at file:line and the check fails closed (default-on flags and an unset NODE_ENV are named traps). Unconfirmed guards are listed unverified after proven findings at their provisional severity, matching method.md. Evals env-gated-dev-bypass-not-reported and default-on-flag-guard-still-reported pin both directions with fictional fixtures. Tests: 166/169 in scripts/test-ci-gates.sh locally; the 3 failures are environment-only (byte-budget check, since derived size rows are regenerated by CI; dcr-gates opt-in default-off and refix_gate/serial_gate checks, which hit sandbox lock and network limits). mustload ok, privacy clean, run-evals dry-run ok, test_appsec_split 7/7. size-budget-raise: .claude/skills/deep-code-review/references/security-review-mode.md 13589→14643 inline guard check for whole-app security mode Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #2295.
BLUF: Whole-app security audits must find and cite the guard for each candidate before filing it, with a fail-closed rule for env/dev gates. Revision after review of #2295.
Changes vs #2295:
NODE_ENVare named traps; otherwiseunverified.method.md.appsec-verify.mdsection 1 and carries only the delta (five guard classes, env rule, whole-app lead vs listed-unverified split).default-on-flag-guard-still-reported.security-review-mode.mdnow 13589 to 14643.Why a new PR: the amend changed the sha, and pushing to the #2295 branch would need a force-push.
Tests: mustload ok, test_appsec_split 7/7, run-evals dry-run ok, test-ci-gates.sh 166 pass / 3 environment-only fails (byte-budget derived rows regenerated by CI; dcr-gates opt-in checks hitting sandbox lock/network limits).
Not merged.
🤖 Generated with Claude Code