Security

Security risk assessment gates unsafe code changes by analyzing auth, permissions, secrets, untrusted input, sensitive data, and CI/CD exposure. It maps threat surfaces and trust boundaries to return blocking questions and controls before implementation proceeds.

Threat modeling is needed when adding authentication, handling secrets, changing file or network access, introducing new dependencies, or updating CI/CD pipelines. It maps where untrusted inputs and sensitive data can be exposed so controls can be added intentionally.

Review dependency and supply chain risks by flagging risks introduced by new packages, CI/CD changes, and external integrations. This assessment identifies where these updates could weaken security posture and returns required controls based on provided artifacts.

Yes, automated security gatekeeping evaluates authz and authn modifications by analyzing trust boundaries and sensitive data flows. It sets the correct gate decision and produces blocking questions so only evidence-backed authentication changes move forward.

Security review handles untrusted input and sensitive data exposure by mapping trust boundaries and data flows. It identifies where sensitive data can be exposed and returns actionable, gating-focused outputs with controls that must be added before implementation.

The security risk assessment outputs a single JSON security output matching the shared artifact envelope. This output includes artifact_type and body set to the SecurityOutput contract, containing blocking questions and gate decisions for pipeline integration.