chore(security): enable security-guidance plugin with repo rules#69
Conversation
Enable the security-guidance@claude-plugins-official plugin in checked-in settings and add .claude/claude-security-guidance.md describing this repo's tenancy, auth, artifact, and secret-handling threat model for the plugin's model-backed reviews.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdded dashboard security guidance for tenant isolation, authentication, artifact downloads, secrets, logging, injection safety, and reviewer findings, then enabled the corresponding Claude plugin. ChangesSecurity guidance
Estimated code review effort: 1 (Trivial) | ~5 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
wrightful | 1bd636d | Jul 23 2026, 11:23 AM |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cb17fdf77c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - Every run-scoped query MUST filter by a branded `projectId` (and by `teamId` | ||
| on the `runs` table). Flag any query over `runs`, `testResults`, | ||
| `testResultAttempts`, `testTags`, `testAnnotations`, `artifacts`, `monitors`, |
There was a problem hiding this comment.
This tells the reviewer plugin that every runs query lacking both tenant columns is a leak, but the same guidance explicitly blesses runByIdWhere. That helper deliberately scopes a globally unique run ID by projectId alone (apps/dashboard/src/lib/scope.ts:221), and is used for safe run-detail and ingest reads; consequently, reviews following this file will repeatedly flag the established predicate as a security defect. State the single-run-ID exception (or require runScopeWhere only for list/aggregate queries) so the guidance remains internally consistent.
Useful? React with 👍 / 👎.
✅ Wrightful — 51 passed
View run report → · Compare to base → Commit: |
Clarify that projectId-alone scoping is correct for globally-unique ULID lookups (runByIdWhere, childByIdWhere); only list/aggregate runs queries AND teamId. Prevents the reviewer plugin from flagging the blessed predicates.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3515aa92fd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - Every run-scoped query MUST filter by a branded `projectId`. Flag any query | ||
| over `runs`, `testResults`, `testResultAttempts`, `testTags`, | ||
| `testAnnotations`, `artifacts`, `monitors`, `monitorExecutions`, or | ||
| `quarantinedTests` that lacks a project filter. |
There was a problem hiding this comment.
This applies to any query over these tables, but scheduled maintenance deliberately enumerates rows across projects before reapplying per-row scope: for example, sweepStaleRuns selects stale rows from runs without a project predicate, and the monitor scheduler similarly selects due monitors globally. As written, the plugin will flag those required cron queries as cross-tenant leaks whenever they are changed, creating false-positive security reviews; carve out trusted maintenance/cron scans that do not expose tenant data and perform scoped mutations.
Useful? React with 👍 / 👎.
| artifact download is a signed token. Flag new `/api/*` routes that read tenant | ||
| data without an explicit auth check. |
There was a problem hiding this comment.
A handler need not contain its own auth check when the route is protected by the global middleware: /api/v1/runs, for example, relies on 02.api-auth.ts to validate Bearer credentials and then calls getApiKey(c). This instruction will cause correctly wired new ingest/query handlers to be reported merely because the check is centralized; require reviewers to verify the route matcher and middleware ordering rather than demanding a handler-local check.
AGENTS.md reference: AGENTS.md:L106-L108
Useful? React with 👍 / 👎.
Address two P2 false-positive risks: (1) fleet-wide maintenance scans (staleRunFilter sweep, dueMonitorsWhere scheduler) legitimately SELECT across projects then scope per-row, and (2) Bearer ingest/query handlers rely on 02.api-auth.ts centrally, so they carry no handler-local auth check. Tell the reviewer to verify the cron/queue context and the middleware route matcher rather than flag these as leaks.
1 participant
What & why
Enables the
security-guidance@claude-plugins-officialplugin in checked-in.claude/settings.jsonso it loads in cloud sessions and for everyone who clones the repo, and adds.claude/claude-security-guidance.mddescribing this repo's threat model for the plugin's model-backed reviews. The guidance is grounded in the actual code — tenant isolation via branded scope ids insrc/lib/scope.ts, the Bearer/session/OAuth auth surfaces inmiddleware/02.api-auth.ts, signed-token artifact downloads, and secret/logging/injection conventions — so end-of-turn and commit reviews flag cross-tenant leaks and auth bypasses in Wrightful's terms rather than generically.How verified
Config/docs only, no runtime code; the pre-commit hook (
vp fmt) ran and reformatted the files on commit.pnpm checkpasses (format + lint + type-check)pnpm test/pnpm --filter … test/pnpm test:e2e)docs/worklog/for non-trivial changespnpm --filter @wrightful/dashboard db:generate)pnpm changeset)Notes for reviewers
The guidance file is advisory context for the security-guidance plugin's reviewer model — additive only, it surfaces findings for Claude to fix and does not block writes. Lookup also supports
~/.claude/...(per-machine) and.claude/claude-security-guidance.local.md(gitignored personal overrides) if reviewers want to extend it.Summary by CodeRabbit