|
| 1 | +--- |
| 2 | +id: dso-5ooy |
| 3 | +status: open |
| 4 | +deps: [w21-ykic, w21-ovpn] |
| 5 | +links: [] |
| 6 | +created: 2026-03-21T23:27:40Z |
| 7 | +type: epic |
| 8 | +priority: 2 |
| 9 | +assignee: Joe Oakhart |
| 10 | +--- |
| 11 | +# Conditional Security & Performance Review Overlays |
| 12 | + |
| 13 | + |
| 14 | +## Notes |
| 15 | + |
| 16 | +<!-- note-id: k3xxzh2r --> |
| 17 | +<!-- timestamp: 2026-03-21T23:28:18Z --> |
| 18 | +<!-- origin: agent --> |
| 19 | +<!-- sync: unsynced --> |
| 20 | + |
| 21 | + |
| 22 | +## Context |
| 23 | + |
| 24 | +Security and performance concerns cut across all review dimensions but don't belong as permanent sub-criteria in every review — they waste tokens on changes with no security/performance surface. This epic adds conditional review overlays that trigger only when the classifier detects relevant signals, orthogonal to the tier system (any tier can trigger an overlay). |
| 25 | + |
| 26 | +## Brainstorm Research (to be resumed) |
| 27 | + |
| 28 | +### Architecture Decision |
| 29 | +- Security and performance reviews are **conditional overlays**, not permanent dimensions |
| 30 | +- Triggered by classifier signals alongside tier routing: classifier emits trigger flags (security_review: true, performance_review: true) |
| 31 | +- Any tier level can trigger an overlay — a Light tier change touching auth still gets security review |
| 32 | +- Each overlay has its own dedicated reviewer agent, checklist, and findings that merge into reviewer-findings.json |
| 33 | + |
| 34 | +### Security Review Triggers (proposed) |
| 35 | +- Code that touches external integrations |
| 36 | +- Code that touches data layer |
| 37 | +- Authentication or authorization code |
| 38 | +- Encryption-related code |
| 39 | + |
| 40 | +### Security Review Criteria (from research) |
| 41 | +Source: Anthropic claude-code-security-review (OWASP-aligned) |
| 42 | +- Injection attacks: SQL, command, LDAP, XPath, NoSQL, XXE |
| 43 | +- Authentication & authorization: broken auth, privilege escalation, insecure direct object references, auth bypass, session flaws |
| 44 | +- Data exposure: hardcoded secrets, sensitive data logging, information disclosure, PII handling violations |
| 45 | +- Cryptographic issues: weak algorithms, improper key management, insecure RNG |
| 46 | +- Input validation: missing validation, improper sanitization, buffer overflows |
| 47 | +- Business logic flaws: race conditions, TOCTOU (time-of-check-time-of-use) |
| 48 | +- Configuration security: insecure defaults, missing security headers, permissive CORS |
| 49 | +- Supply chain: vulnerable dependencies, typosquatting |
| 50 | +- Code execution: RCE via deserialization, pickle injection, eval injection |
| 51 | +- XSS: reflected, stored, DOM-based |
| 52 | +- Error message information leakage (OWASP): errors that reveal internal state |
| 53 | + |
| 54 | +### Performance Review Triggers (proposed) |
| 55 | +- Any operation more expensive than O(n) |
| 56 | +- Code that touches infrastructure |
| 57 | +- Code that touches data layer |
| 58 | +- Future enhancement: trigger on spike in test runtime or application latency in E2E testing (needs friction-free way to surface this data) |
| 59 | + |
| 60 | +### Performance Review Criteria (from research) |
| 61 | +- N+1 query problems |
| 62 | +- Nested loops over large datasets |
| 63 | +- Inefficient algorithms or database queries |
| 64 | +- Memory usage patterns and potential leaks |
| 65 | +- Bundle size and optimization opportunities |
| 66 | +- Sequential I/O where parallel is possible (AI-specific) |
| 67 | +- Image optimization |
| 68 | + |
| 69 | +### Integration Architecture (to be designed) |
| 70 | +Pipeline becomes: classifier → tier + overlay triggers → dispatch tier reviewer(s) + overlay reviewer(s) → merged findings → resolution loop |
| 71 | +- Overlay reviewers need own agent definitions and checklists |
| 72 | +- Findings merge into same reviewer-findings.json and scoring |
| 73 | +- Classifier/dispatch changes needed to trigger overlays |
| 74 | +- Performance runtime trigger (pytest --durations baseline comparison) deferred as future enhancement to avoid friction |
| 75 | + |
| 76 | +### Open Questions |
| 77 | +- Exact classifier signal thresholds for triggering overlays |
| 78 | +- Whether overlays should have their own severity scale or use the existing critical/important/minor |
| 79 | +- How overlay findings interact with the autonomous resolution loop |
| 80 | +- Whether the security overlay replaces or supplements the existing dso-0wi2 sensitive-info security review |
| 81 | + |
| 82 | +## Dependencies |
| 83 | +- w21-ykic (Tiered Review Architecture): requires classifier infrastructure to add overlay trigger signals |
| 84 | +- w21-ovpn (Review Intelligence & Precision): requires enriched checklist architecture (reviewer-delta files, confidence scoring, false-positive filters) |
| 85 | + |
0 commit comments