security-review

A security review on a pull request applies STRIDE threat modeling and risk-tiered analysis to identify exploitable vulnerabilities. It outputs a structured Security Review Report with CWE mappings and CVSS v4.0 severity ratings for remediation.

STRIDE threat modeling identifies security risks across trust boundaries and data flows to validate mitigations. It cross-references ATT&CK techniques to ensure shipped code changes are properly secured against exploitable vulnerabilities.

Security findings are mapped to NIST SSDF and OWASP ASVS by classifying vulnerabilities against their compliance requirements during risk-tiered code analysis. This framework-aligned approach ensures consistent classification and generates actionable compliance evidence.

Automated security gates verify supply-chain risks by enforcing SBOM generation, SCA reachability analysis, and SLSA provenance checks on dependency changes. The review outputs a machine-readable pipeline summary to validate these requirements before release.

Security analysis detects AI-specific risks including prompt injection, data and model poisoning, excessive agent privileges, and PII leakage. These checks are integrated into the risk-tiered review to secure AI components before deployment.

Assessing CVSS v4.0 severity is best achieved through a structured security review that evaluates exploitable vulnerabilities in shipped code. The process generates a report detailing severity scores and supply chain status for prioritized remediation.