pennaburry/parallel-constrained-decoding

1{2  "id": "code_security",3  "title": "Autonomous Code Security & PR Vulnerability Triage (28 Fields)",4  "description": "Automated SAST/DAST static analysis triage evaluating an enterprise pull request containing leaked secrets and injection risks.",5  "context": "CI/CD PIPELINE AUDIT #PR-10822\nRepository: payment-gateway-core\nBranch: feature/direct-stripe-integration -> main\nAuthor: external-contractor-92 (First PR submitted)\nDiff Summary: +482 lines, -12 lines in src/services/charge_processor.py and config/aws.env\n\nStatic Scanner Findings:\n1. Hardcoded Plaintext AWS Root Secret: AWS_SECRET_ACCESS_KEY=\"AKIAIOSFODNN7EXAMPLE...\" committed into config/aws.env\n2. Unsanitized SQL Query Concatenation: cursor.execute(f\"SELECT * FROM users WHERE id = '{req.user_id}' AND secret = '{req.token}'\")\n3. Insecure Deserialization: pickle.loads(base64.b64decode(req.headers['X-Payload'])) detected in webhook handler.\n4. Dependency Check: Added vulnerable PyPI package 'requests-oauthlib==0.4.0' with 3 critical CVEs.\n\nDeployment Target: PRODUCTION (us-west-2 Kubernetes Cluster)\nCompliance Scope: SOC2 Type II, PCI-DSS Level 1, HIPAA\nSecurity Gate Status: FAILED_BLOCKING",6  "schema": {7    "is_vulnerability": {8      "type": "boolean",9      "description": "Whether pull request introduces severe security vulnerabilities"10    },11    "primary_cwe": {12      "type": "enum",13      "description": "Primary vulnerability classification",14      "choices": [15        "CWE_89_SQL_INJECTION",16        "CWE_798_HARDCODED_CREDENTIALS",17        "CWE_502_DESERIALIZATION",18        "CWE_20_IMPROPER_INPUT"19      ]20    },21    "secondary_cwe": {22      "type": "enum",23      "description": "Secondary vulnerability indicator",24      "choices": [25        "CWE_798_HARDCODED_CREDENTIALS",26        "CWE_1104_OUTDATED_COMPONENTS",27        "CWE_200_INFO_EXPOSURE",28        "NONE"29      ]30    },31    "severity_level": {32      "type": "enum",33      "description": "Combined security severity tier",34      "choices": [35        "CRITICAL",36        "HIGH",37        "MEDIUM",38        "LOW"39      ]40    },41    "block_pull_request": {42      "type": "boolean",43      "description": "Whether CI/CD merge should be immediately blocked"44    },45    "quarantine_branch": {46      "type": "boolean",47      "description": "Whether git branch should be locked and quarantined"48    },49    "credential_revocation_required": {50      "type": "boolean",51      "description": "Whether AWS IAM credentials must be revoked immediately"52    },53    "requires_security_lead_signoff": {54      "type": "boolean",55      "description": "Whether AppSec lead signature is required to unblock"56    },57    "exploitability_in_production": {58      "type": "enum",59      "description": "Production exploitability ease",60      "choices": [61        "REMOTE_UNAUTHENTICATED",62        "AUTHENTICATED_USER",63        "INTERNAL_NETWORK_ONLY",64        "THEORETICAL"65      ]66    },67    "blast_radius": {68      "type": "enum",69      "description": "Potential system impact scope",70      "choices": [71        "FULL_AWS_ACCOUNT",72        "DATABASE_COMPROMISE",73        "CONTAINER_LOCAL",74        "NONE"75      ]76    },77    "auto_generate_fix": {78      "type": "boolean",79      "description": "Whether automated remediation patch should be PRed"80    },81    "remediation_effort": {82      "type": "enum",83      "description": "Estimated fix complexity",84      "choices": [85        "TRIVIAL_SECRETS_ROTATION",86        "PARAMETRIZED_SQL_REFACTOR",87        "MAJOR_ARCHITECTURE_CHANGE"88      ]89    },90    "pci_dss_impact": {91      "type": "boolean",92      "description": "Whether findings trigger PCI-DSS compliance breach"93    },94    "soc2_audit_flag": {95      "type": "boolean",96      "description": "Whether finding must be logged for annual SOC2 audit"97    },98    "hipaa_exposure_risk": {99      "type": "boolean",100      "description": "Whether patient ePHI data is exposed"101    },102    "secret_type_detected": {103      "type": "enum",104      "description": "Specific secret credential leaked",105      "choices": [106        "AWS_ROOT_KEY",107        "STRIPE_API_KEY",108        "DATABASE_PASSWORD",109        "NONE"110      ]111    },112    "target_environment": {113      "type": "enum",114      "description": "Destination deployment environment",115      "choices": [116        "PRODUCTION_CLUSTER",117        "STAGING_ENVIRONMENT",118        "LOCAL_DEV"119      ]120    },121    "notify_ciso": {122      "type": "boolean",123      "description": "Whether CISO must be paged on mobile"124    },125    "requires_immediate_patch": {126      "type": "boolean",127      "description": "Whether zero-day emergency patch window applies"128    },129    "jira_ticket_priority": {130      "type": "enum",131      "description": "Jira security queue priority",132      "choices": [133        "P0_BLOCKER",134        "P1_CRITICAL",135        "P2_MAJOR",136        "P3_MINOR"137      ]138    },139    "assigned_team": {140      "type": "enum",141      "description": "Primary team responsible for remediation",142      "choices": [143        "APP_SEC_TEAM",144        "INFRA_CLOUD_SEC",145        "CORE_BACKEND",146        "DEVOPS_PLATFORM"147      ]148    },149    "false_positive_risk": {150      "type": "enum",151      "description": "Likelihood of false positive scan finding",152      "choices": [153        "ALMOST_ZERO",154        "LOW",155        "MODERATE",156        "HIGH"157      ]158    },159    "public_cve_match": {160      "type": "boolean",161      "description": "Whether findings match known public CVE databases"162    },163    "auto_merge_allowed": {164      "type": "boolean",165      "description": "Whether branch can merge under any circumstance"166    },167    "container_escape_risk": {168      "type": "boolean",169      "description": "Whether vulnerability allows Docker/Kubernetes container breakout"170    },171    "data_exfiltration_risk": {172      "type": "enum",173      "description": "Risk of bulk sensitive data theft",174      "choices": [175        "CATASTROPHIC",176        "HIGH",177        "MODERATE",178        "NEGLIGIBLE"179      ]180    },181    "author_trust_score": {182      "type": "enum",183      "description": "Author risk profile evaluation",184      "choices": [185        "UNTRUSTED_EXTERNAL",186        "NEW_EMPLOYEE",187        "VERIFIED_STAFF",188        "CORE_MAINTAINER"189      ]190    },191    "security_gate_status": {192      "type": "enum",193      "description": "Final policy engine disposition",194      "choices": [195        "FAILED_BLOCKING",196        "WARNING_OVERRIDABLE",197        "PASSED"198      ]199    }200  }201}