c6c1364dd6
* Sync agent pipeline artifacts to 0.6.0. Add model routing defaults, L2 role updates, convoy telemetry, and manifest tracking without touching unrelated in-progress work. * Record tcg-vault interactive sync (kept local L1/L3 customizations). Update last_synced_at after reviewing behind/conflict artifacts; no overwrites applied. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(agent-pipeline): sync 0.6.0 — implementer Mode 2 fix pass + UI designer - role-implementer Mode 2 (fix pass) and role-reviewer hand-off - role-ui-designer + model-routing updates from upstream 783e2a3 - manifest last_synced_at bumped Co-authored-by: Cursor <cursoragent@cursor.com> * chore(agent-pipeline): sync v0.7.0 model routing Composer Standard for architect, Grok for audit fan-out, Sonnet 5 escalation path. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(agent-pipeline): finish 0.6.0/0.7.0 sync on branch Install security baseline, convoy planning, security-audit and ui-ux-pro-max skills; align PR template and metrics docs with convoy-metrics-gate; refresh manifest hashes while keeping tcg-vault-local L1/L3 customizations. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
1.2 KiB
1.2 KiB
Security audit — {{convoy_slug}} / brief-{{brief_n}}
Reviewer: role-security-auditor Convoy: {{convoy_slug}} Brief / PR: {{brief_n}} / {{pr_number_or_draft}} Date: {{YYYY-MM-DD}} Diff scope: {{files_changed_count}} files
Executive summary
- {{bullet 1 — overall risk posture}}
- {{bullet 2 — highest severity finding or "no sev ≥ 3"}}
- {{bullet 3 — auth/IDOR/injection/deps headline}}
Findings
| Sev | Layer | Surface | Issue | Fix |
|---|---|---|---|---|
| 4 | L2 AuthZ | app/api/foo/route.ts:42 |
IDOR: userId from path not checked against session |
Add if (session.user.id !== params.id) return forbidden() |
| 2 | L3 Input | app/api/bar/route.ts:18 |
Body not validated | Add Zod schema per api-routes.mdc |
Severity ≥ 3 detail
{{Expand each sev 3–4 with exploit scenario + suggested patch.}}
Patterns (optional)
{{One row if the same mistake appears 3+ times.}}
Automated checks
| Check | Result |
|---|---|
npm audit (high+) |
{{pass / N findings}} |
| Hardcoded secret grep | {{pass / findings}} |
Approval recommendation
- approve — no sev ≥ 3; sev 2 acceptable with notes
- request-changes — sev ≥ 3 open
- comment-only — informational