security-review-spec

You can review the security of a design-spec PR by auditing its diff to identify high-level risks, trust boundaries, and data handling concerns. This process evaluates authentication and authorization assumptions before implementation begins.

Threat surface assessment for spec changes is the process of evaluating PR diffs to surface design-level security gaps. It frames risks and analyzes modified data flows to ensure security is integrated before code implementation.

You consolidate security findings into review.json by enforcing the base spec review structure. The security review appends its identified risks and trust boundary concerns into the existing review.json file without making direct code changes.

Yes, you can use a security review to check authentication and authorization assumptions in a PR. The review specifically evaluates these assumptions alongside trust boundaries and data handling concerns within the spec diff.

No, the security review process does not modify code in the PR. It specifically avoids direct code changes, focusing instead on guiding what security risks to flag and how to report them within the review.json file.

You need a prompt-injection risk assessment for spec reviews when PR changes modify threat surfaces or data flows. The assessment identifies high-level risks and ensures findings fold into the single review.json produced by the base spec review.