e-volv

Security playbook

AuthSurfaceDiff

Compares the authentication and authorization surface of every route before and after a PR, flagging any route that gained public reachability.

On every pull request, computes the delta in the authentication and authorization surface rather than reviewing the diff as prose. It enumerates, before and after, every controller route and the guards applied to it — class-level and method-level @UseGuards, @Public or equivalent opt-outs, role decorators, and middleware registration order. Any route that gained public reachability, lost a guard, or changed its required role is reported as a finding with its before/after state. A route added with no guard at all is reported as a finding even though nothing was removed. Clean runs post nothing.

Identifier
auth-surface-diff
Version
1.0.1
Steps
4
Triggers
2
  • security
  • auth
  • authorization
  • guards
  • pull-request
  • diff

When it runs

Pull requestpull_request.opened
Settle delay
15s after the event

Only when all hold

  • pullRequest.isDraft not equals true
  • actor.username not in dependabot, dependabot[bot], renovate, renovate[bot], github-actions, github-actions[bot]
  • actor.username not contains [bot]
Pull requestpull_request.synchronize
Settle delay
30s after the event

Only when all hold

  • pullRequest.isDraft not equals true
  • actor.username not in dependabot, dependabot[bot], renovate, renovate[bot], github-actions, github-actions[bot]
  • actor.username not contains [bot]

The pipeline

The graph below is the one the workflow opens with in the builder — same steps, same layout, drawn on the same canvas. The run playing through it is a simulation; the branches and conditions are real.

React Flow
  1. 01
    PR Opened / Synchronizedtrigger

    The event that starts the run.

  2. 02
    Clone Repositorygit.clone

    Shallow-clones the repository at the right ref.

  3. 03
    Compute Auth Surface Deltaagent.run

    One agent works the task with its toolkit.

  4. 04
    Publish Auth Surface Reportreport.publish

    Posts or updates a deduplicated report comment.

The agent

Auth Surface Diff Reviewer

Base type
Code Reviewer
Temperature
0.2
Max iterations
30
Tools
5

Git provider · 2

  • get_pull_request_diffGet Pull Request Diff · read
  • add_pull_request_review_threadAdd PR Review Thread · write

Filesystem · 1

  • read_fileRead File · read

Code search · 1

  • code_searchCode Search · read

Status · 1

  • update_statusUpdate Status · write