c6c1364dd6
* Sync agent pipeline artifacts to 0.6.0. Add model routing defaults, L2 role updates, convoy telemetry, and manifest tracking without touching unrelated in-progress work. * Record tcg-vault interactive sync (kept local L1/L3 customizations). Update last_synced_at after reviewing behind/conflict artifacts; no overwrites applied. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(agent-pipeline): sync 0.6.0 — implementer Mode 2 fix pass + UI designer - role-implementer Mode 2 (fix pass) and role-reviewer hand-off - role-ui-designer + model-routing updates from upstream 783e2a3 - manifest last_synced_at bumped Co-authored-by: Cursor <cursoragent@cursor.com> * chore(agent-pipeline): sync v0.7.0 model routing Composer Standard for architect, Grok for audit fan-out, Sonnet 5 escalation path. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(agent-pipeline): finish 0.6.0/0.7.0 sync on branch Install security baseline, convoy planning, security-audit and ui-ux-pro-max skills; align PR template and metrics docs with convoy-metrics-gate; refresh manifest hashes while keeping tcg-vault-local L1/L3 customizations. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
41 lines
1.2 KiB
Markdown
41 lines
1.2 KiB
Markdown
# Security audit — {{convoy_slug}} / brief-{{brief_n}}
|
||
|
||
**Reviewer:** role-security-auditor
|
||
**Convoy:** {{convoy_slug}}
|
||
**Brief / PR:** {{brief_n}} / {{pr_number_or_draft}}
|
||
**Date:** {{YYYY-MM-DD}}
|
||
**Diff scope:** {{files_changed_count}} files
|
||
|
||
## Executive summary
|
||
|
||
- {{bullet 1 — overall risk posture}}
|
||
- {{bullet 2 — highest severity finding or "no sev ≥ 3"}}
|
||
- {{bullet 3 — auth/IDOR/injection/deps headline}}
|
||
|
||
## Findings
|
||
|
||
| Sev | Layer | Surface | Issue | Fix |
|
||
| --- | --- | --- | --- | --- |
|
||
| 4 | L2 AuthZ | `app/api/foo/route.ts:42` | IDOR: `userId` from path not checked against session | Add `if (session.user.id !== params.id) return forbidden()` |
|
||
| 2 | L3 Input | `app/api/bar/route.ts:18` | Body not validated | Add Zod schema per `api-routes.mdc` |
|
||
|
||
### Severity ≥ 3 detail
|
||
|
||
{{Expand each sev 3–4 with exploit scenario + suggested patch.}}
|
||
|
||
### Patterns (optional)
|
||
|
||
{{One row if the same mistake appears 3+ times.}}
|
||
|
||
## Automated checks
|
||
|
||
| Check | Result |
|
||
| --- | --- |
|
||
| `npm audit` (high+) | {{pass / N findings}} |
|
||
| Hardcoded secret grep | {{pass / findings}} |
|
||
|
||
## Approval recommendation
|
||
|
||
- [ ] **approve** — no sev ≥ 3; sev 2 acceptable with notes
|
||
- [ ] **request-changes** — sev ≥ 3 open
|
||
- [ ] **comment-only** — informational
|