ThreatMind fix: Registration lets users self-assign admin role #15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Claude Security Review | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, ready_for_review, reopened] | |
| jobs: | |
| security: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| id-token: write | |
| steps: | |
| - name: Checkout PR | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 2 | |
| - name: Generate Security Policy Instructions | |
| run: | | |
| cat <<'EOF' > security_policy.md | |
| You are a Principal Application Security Engineer performing a security-focused code review. | |
| ## CRITICAL – Block PR if found: | |
| - Hardcoded secrets, tokens, credentials | |
| - SQL Injection | |
| - Remote Code Execution | |
| - Path traversal | |
| - Unsafe deserialization | |
| - Missing authentication/authorization on sensitive endpoints | |
| - Sensitive data exposure | |
| ## HIGH – Must Fix: | |
| - XSS | |
| - SSRF | |
| - IDOR | |
| - CSRF missing protections | |
| - XXE | |
| - Weak cryptography | |
| - Race conditions affecting security | |
| ## MEDIUM – Fix before production: | |
| - Missing input validation | |
| - Overly permissive CORS | |
| - Missing security headers | |
| - Missing rate limiting | |
| - Dependency vulnerabilities | |
| - Insufficient logging | |
| ## Technology Specific Checks | |
| ### Python | |
| - eval(), exec() | |
| - pickle/yaml.load unsafe | |
| - subprocess shell=True | |
| - missing authentication decorators | |
| - weak password hashing | |
| - JWT validation flaws | |
| ### JavaScript/TypeScript | |
| - innerHTML with user input | |
| - eval()/Function() | |
| - insecure postMessage | |
| - localStorage for sensitive data | |
| - exposed API keys | |
| ### Infrastructure (Terraform) | |
| - 0.0.0.0/0 ingress | |
| - "*" IAM policies | |
| - unencrypted storage | |
| - public S3 buckets | |
| - missing logging | |
| ## Output Format | |
| For each finding: | |
| :red_circle: CRITICAL | :large_yellow_circle: HIGH | :large_orange_circle: MEDIUM | :large_blue_circle: LOW | |
| **Issue:** | |
| **Location:** File:Line | |
| **Risk:** | |
| **Fix:** | |
| **Reference:** CWE/OWASP if applicable | |
| ## Summary | |
| - Security Score: PASS or FAIL | |
| - Count by severity | |
| - Must-fix before merge | |
| - Positive security practices observed | |
| Focus strictly on security. Ignore style or performance unless security-related. | |
| EOF | |
| - name: Claude security review | |
| uses: anthropics/claude-code-action@v1 | |
| with: | |
| anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} | |
| prompt: | | |
| REPO: ${{ github.repository }} | |
| PR NUMBER: ${{ github.event.pull_request.number }} | |
| Below is the mandatory security review policy to follow strictly: | |
| $(cat security_policy.md) | |
| Analyze ALL changes in this PR and produce a structured security review according to the policy above. | |
| Use inline comments for line-level issues and one top-level summary comment. | |
| claude_args: | | |
| --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)" |