Repository navigation
Add insecure-defaults and fail-open detector to review_checks.sh - #2297
Closed
remigiusz-antczak wants to merge 1 commit into
Closed
remigiusz-antczak wants to merge 1 commit into
remigiusz-antczak wants to merge 1 commit into
Conversation
A deterministic pass now flags literal insecure defaults and fail-open paths that the review otherwise only catches by reading: a security flag whose default turns the protection off, a broad exception in an auth check that returns allow, TLS or JWT verification disabled in code, debug on by default, and a wildcard CORS origin with credentials. insecure_defaults.py emits the same TSV rows as the other detectors and is wired as tool insecure-defaults with the shared SKIPPED handling. Test paths, comments, localhost lines and fail-closed variants stay silent. Whole-app security mode routes the rows to a shipped-config check, and one eval pins the keep-versus-drop behavior. Tests: 4/4 in scripts/test_insecure_defaults.py (12 positive fixtures exact, 14 decoy fixtures silent); 166/169 in scripts/test-ci-gates.sh locally, the 3 failures are environment-only (byte-budget check since derived size rows are regenerated by CI, and dcr-gates opt-in checks that hit sandbox limits). mustload ok, test_appsec_split 7/7. size-budget-raise: .claude/skills/deep-code-review/references/security-review-mode.md 14643→14821 route insecure-defaults rows Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Collaborator
Author
|
Superseded by #2298. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
BLUF: adds a deterministic insecure-defaults / fail-open pass to
review_checks.sh --full(toolinsecure-defaults), closing gap-map row 1.Classes: security flag defaulting off, broad exception in an auth check returning allow, TLS verify off, JWT alg none or verify off, debug on by default, wildcard CORS with credentials. Rows use the existing TSV format and shared SKIPPED handling. Test paths, comments, localhost lines and fail-closed variants stay silent.
Tests: 4/4 in
scripts/test_insecure_defaults.py(12 positive fixtures exact, 14 decoy fixtures silent). Localtest-ci-gates.sh166/169; the 3 failures are environment-only. Also routed fromsecurity-review-mode.md(one sentence), one eval added, changelog fragment and CI registration included.Reviewer note: derived INDEX, SHA256SUMS and size rows are left to land-time regen; size-budget-raise marker is in the commit.
🤖 Generated with Claude Code