---ci---
project: ci
phase: 3
milestone: v0.8
status: complete
decisions:
- id: D-029
decision: Full STRIDE 7-category coverage with CWE mapping
rationale: Industry standard threat classification with actionable CWE remediation
confidence: 0.88
- id: D-030
decision: Reduce exec/eval false positives via string interpolation detection
rationale: execSync("ls") is safe; execSync(`rm ${x}`) is not
confidence: 0.85
requirements:
covered: [SEC-01, SEC-02, SEC-03, SEC-04, SEC-05, SEC-06]
---/ci---
SEC-01: Fixed STRIDE category misassignments. Hardcoded password is
information_disclosure (CWE-259), not spoofing. exec with interpolation
is elevation_of_privilege (CWE-78), not tampering. All 17 patterns
correctly categorized.
SEC-02: Added missing STRIDE categories: repudiation (empty catch blocks,
CWE-778) and spoofing (jwt.decode without verify, CWE-287). Also added
denial_of_service (JSON body parser without size limit, CWE-400) and
prototype pollution (CWE-1321), weak crypto (CWE-328), unsafe
deserialization (CWE-502), path traversal (CWE-22).
SEC-03: Reduced false positives: exec/eval patterns now require string
interpolation (template literal or dynamic concat), not all exec/calls.
SEC-04: Every SECURITY_PATTERNS entry has a cwe field with valid CWE ID.
SEC-05: Confidence-based auto-disposition: each pattern has a confidence
score. High confidence findings are flagged, medium require verification,
low are suppressed. Threshold configurable via constructor.
SEC-06: Security passed=false when any high-severity finding exists
(already enforced by hasHighFail check, now more explicit).
Jon Chery
grimacing