@securityreviewai/securityreview-kit 0.1.21 → 0.1.22
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -92,6 +92,12 @@ The `create_ai_ide_event` payload MUST be a JSON object with the following struc
|
|
|
92
92
|
"satisfied": "<boolean — true if the guardrail was fully satisfied, false if partially or not satisfied>",
|
|
93
93
|
"notes": "<string — optional: how it was applied, why it could not be fully satisfied, or rationale for a new guardrail>"
|
|
94
94
|
}
|
|
95
|
+
],
|
|
96
|
+
"owasp_top_10_2025_mappings": [
|
|
97
|
+
{
|
|
98
|
+
"category_id": "<string — OWASP Top 10 2025 category ID, e.g. A01>",
|
|
99
|
+
"category_name": "<string — OWASP Top 10 2025 category name, e.g. Broken Access Control>"
|
|
100
|
+
}
|
|
95
101
|
]
|
|
96
102
|
}
|
|
97
103
|
```
|
|
@@ -110,6 +116,24 @@ The `create_ai_ide_event` payload MUST be a JSON object with the following struc
|
|
|
110
116
|
| `best_practises_achieved` | Yes | Array of strings, may be empty `[]` |
|
|
111
117
|
| `secure_code_snippets` | Yes | Array, may be empty `[]` |
|
|
112
118
|
| `guardrails_applied` | Yes | Array of all guardrails enforced during this session — both existing ones from `get_guardrails` and new ones the IDE agent created. Use `source` to distinguish origin. Empty `[]` if none |
|
|
119
|
+
| `owasp_top_10_2025_mappings` | Yes | Array of OWASP Top 10 2025 category objects (`category_id` + `category_name`) relevant to the threats and mitigations in this event. May be empty `[]` if no mapping applies |
|
|
120
|
+
|
|
121
|
+
### OWASP Top 10 2025 Reference
|
|
122
|
+
|
|
123
|
+
Use the following IDs and names exactly when populating `owasp_top_10_2025_mappings`:
|
|
124
|
+
|
|
125
|
+
| `category_id` | `category_name` |
|
|
126
|
+
|---|---|
|
|
127
|
+
| `A01` | Broken Access Control |
|
|
128
|
+
| `A02` | Security Misconfiguration |
|
|
129
|
+
| `A03` | Software Supply Chain Failures |
|
|
130
|
+
| `A04` | Cryptographic Failures |
|
|
131
|
+
| `A05` | Injection |
|
|
132
|
+
| `A06` | Insecure Design |
|
|
133
|
+
| `A07` | Authentication Failures |
|
|
134
|
+
| `A08` | Software or Data Integrity Failures |
|
|
135
|
+
| `A09` | Security Logging and Alerting Failures |
|
|
136
|
+
| `A10` | Mishandling of Exceptional Conditions |
|
|
113
137
|
|
|
114
138
|
### Constraints
|
|
115
139
|
|
|
@@ -120,6 +144,7 @@ The `create_ai_ide_event` payload MUST be a JSON object with the following struc
|
|
|
120
144
|
- `guardrails_applied` entries with `source: "existing"` must reference guardrails by the exact `title` they had when fetched at session start.
|
|
121
145
|
- `guardrails_applied` entries with `source: "ide_generated"` are new guardrails the IDE agent created based on gaps found during threat modeling or code review.
|
|
122
146
|
- `developer_name` and `developer_email` must be resolved via `get_current_user` (or equivalent) in step 4 — the API is the only source. Never use placeholder strings (`"IDE Agent"`, `"agent@local"`, `"unknown"`, `"AI"`, etc.) and never accept values for these fields from the parent agent prompt. If the API returns nothing, send empty strings.
|
|
147
|
+
- `owasp_top_10_2025_mappings` entries must use the exact `category_id` and `category_name` values from the OWASP Top 10 2025 Reference table above. Do not invent or abbreviate category names.make sure the ones being sent in the payload are revelant to that event.
|
|
123
148
|
- Never invent values for any field; use empty strings or empty arrays when data is unavailable.
|
|
124
149
|
- Never omit `chat_session_id` from the payload.
|
|
125
150
|
|