Repository navigation
ci(decision-model-lint): Add API, audit, and security rules - #128453
Merged
Merged
Conversation
github-actions
Bot
added
the
Scope: Frontend
michelletran-sentry
force-pushed
the
ci/decision-model-lint-rules
branch
from
October 22, 2026 00:48
d68048d to
40db1a5
Compare
azulus
approved these changes
Oct 22, 2026
michelletran-sentry
marked this pull request as ready for review
October 22, 2026 17:39
michelletran-sentry
force-pushed
the
ci/decision-model-lint-rules
branch
from
October 22, 2026 17:57
e75b31c to
4e30760
Compare
Add warn-only rules to the decision-model lint config: - api: request bodies read outside a serializer, and webhook payloads read without a serializer or schema. - audit: token issuance and revocation, privilege grants, and account identity changes that are not recorded in an audit entry or security email. - security: caller-supplied secrets compared with == or !=, writes to shared data reachable with only read access, credentials or whole incoming requests sent to telemetry, customer URLs fetched without the safe HTTP client, unvalidated redirects, values formatted into raw SQL, user content marked safe as HTML, and the random module used for secrets. Each rule was tuned against labelled examples and whole-codebase runs. Four security rules use a 0.8 threshold to cut borderline findings. Co-Authored-By: Claude <noreply@anthropic.com>
michelletran-sentry
force-pushed
the
ci/decision-model-lint-rules
branch
from
October 22, 2026 19:02
4e30760 to
234dd9c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add rules for request bodies read outside a serializer and serializer fields without a declared shape, an audit-trail rule for auth state changes, and security rules for secrets sent to telemetry, secret comparisons that are not constant time, and weakened endpoint permissions. All new rules warn and do not fail the check.
The auditlog rule currently has low precision (23%), but if it's only going to be on diffs, might be ok? I'm debating on whether we want to keep that.