Repository navigation
feat(security-model): add Component Map section to policy drafts - #191
Merged
Merged
Conversation
Drafts now map the security-critical directories and files, grouped by the trust level of their input, with a one-line purpose and the invariants each one bears. Paths are backticked so check catches them moving. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
security-modeldrafts now include a Component Map section between the threat model and the invariants. It lists the directories and files a reviewer must treat as security-critical, grouped into one table per input trust level. Each entry gives a one-line purpose and the invariants it bears. Examples of security-critical code: untrusted input parsing, enforcement points, unsafe or native code, authentication, tenant scoping, secrets, and language or network boundaries.The invariants already named their enforcing symbols, but nothing gave reviewers an overview of where untrusted input enters or where unsafe code and bindings live. A real run on a public Rust library surfaced this when the user asked for the map after the first draft.
The drafting rule keeps the map narrow. It maps directories rather than files unless one file holds the control, and leaves out tests, fixtures, and paths with no security role. It marks a group
Unresolvedwhen its trust level is open. Every path is backticked socheckcatches it moving, and SPEC gains that as an acceptance gate. The old "paths that mark a real boundary" wording in the scope bullet is replaced by the new component map item rather than duplicated.🤖 Generated with Claude Code