adam/orchestrator
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
This repository has been archived on 2026-08-04. You can view files and clone it, but cannot push or open issues or pull requests.
orchestrator/security-review
History
Adam Moussa a3ab3f5f40 Make security-review hooks and skill installable from the repo 
The global pre-push hook, the /sh-security-review prompt, and finding.schema.json
previously lived only in ~/.config/git and ~/.claude (untracked) — unreproducible.
Source them here: add hooks/pre-push, rewrite install-hooks.sh with a --global mode
(lays down both hooks, sets core.hooksPath, links skill+schema into ~/.claude) and a
per-repo mode. Align pre-commit with pre-push (honor skip marker + suppressions). Add
semgrep p/javascript so the scanners cover the org's Node/.NET repos.
2026-06-16 15:00:00 -04:00
..
hooks Make security-review hooks and skill installable from the repo 2026-06-16 15:00:00 -04:00
skill Make security-review hooks and skill installable from the repo 2026-06-16 15:00:00 -04:00
DEPLOY-R720.md Tune checkov severity, wire npm audit, add CI backstop + R720 runbook 2026-06-15 15:57:34 -04:00
finding.schema.json Make security-review hooks and skill installable from the repo 2026-06-16 15:00:00 -04:00
install-hooks.sh Make security-review hooks and skill installable from the repo 2026-06-16 15:00:00 -04:00
README.md Add security-review gate (review.sh + scanners + pre-commit hook) 2026-06-15 15:52:15 -04:00
review.sh Make security-review hooks and skill installable from the repo 2026-06-16 15:00:00 -04:00

README.md

security-review

The Sea Haven security-review gate. One pure-code script (review.sh), many triggers. See memory project-security-review-agent for the full design.

Pieces

  • review.sh — merges deterministic-scanner findings + agent findings, dedups, applies suppressions (justification required), and makes the block decision (no agent decides). Exit 1 = BLOCK.
  • hooks/pre-commit + install-hooks.sh — fast scanners-only hook for a target repo.
  • The agentic detector/verifier pass is the interactive /sh-security-review slash command (~/.claude/commands/sh-security-review.md), schema at ~/.claude/security-review/finding.schema.json.

Triggers (one script, many entry points)

  • On-demand (primary): run /sh-security-review in a Claude Code session (Max-covered), have it write its schema JSON, then review.sh --agent-findings out.json <repo> to gate.
  • Pre-commit: install-hooks.sh <repo> — fast deterministic scanners abort the commit early.
  • CI (Phase 3): the same review.sh runs headless as the unbypassable backstop.

Scanners

review.sh runs whatever is installed and logs the rest with install commands (no silent skips). Currently wired: cfn-lint. To give the deterministic layer teeth, install:

pipx install semgrep        # SAST: injection / authz / xss
brew install gitleaks       # hardcoded secrets
pipx install pip-audit      # vulnerable Python deps
pipx install checkov        # IaC / IAM misconfig

Each needs a small normalizer added to review.sh (map its JSON to the finding schema) when installed.

Status

review.sh gate validated against the local testbed: 16 findings, correct dedup of distinct same-CWE findings, suppression-without-justification rejected and surfaced, BLOCK on confirmed crit/high.