mirror of
https://github.com/github/awesome-copilot.git
synced 2026-10-12 23:04:14 +00:00
Burak Kaygusuz
c5a2d812f9
* feat(skills): modularize audit-integrity references for progressive disclosure * refactor(agents): adopt progressive disclosure in sast-sca-security-analyzer * style(skills): format table alignment in security-report-template * refactor(skills): restore domain-agnostic audit-integrity references * refactor(agents): make sast-sca-security-analyzer self-contained
3.2 KiB
3.2 KiB
Anti-Rationalization Guard
These rationalizations are never valid reasons to skip, omit, or downgrade findings:
Universal Rationalizations
| If you think... | Mandatory response |
|---|---|
| "No issues or threats found on first pass" | Systematic evaluation across all categories is required before you conclude clean. Expand scope and complete the full matrix. |
| "This looks fine, skip deep analysis" | "Looks fine" is not evidence. Evidence is a code trace, architecture reference, or rule match. Run checks. |
| "The risk is probably lower in practice" | Risk level is based on impact multiplied by likelihood. Justify any downgrade with explicit evidence. |
| "This is a false positive" | Flag the finding as a potential false positive, but include it. Do not silently suppress findings. Document the rationale. |
| "This is outside scope" | State explicitly why, with a reference to the declared scope or assessment boundary. |
| "No controls or mitigations needed here" | State "No gap identified — rationale: [X]" explicitly. Silence is not assurance. |
SAST/SCA
| If you think... | Mandatory response |
|---|---|
| "SCA CVE is not exploitable here" | Include the CVE with a documented context note. Do not silently suppress. |
| "This phase can be skipped" | All phases are mandatory. Document any phase that you cannot complete due to missing inputs. |
| "Severity should be lower given context" | Severity is based on CVSS or exploitability. Justify any downgrade with explicit evidence. Do not suppress. |
Threat Modeling
| If you think... | Mandatory response |
|---|---|
| "This threat is mitigated by the architecture" | Document the specific compensating control and verify that it is implemented. Do not assume. |
| "This category has no applicable threats here" | State "No applicable threats identified — rationale: [X]" explicitly. Do not silently omit categories. |
| "Lateral movement is unlikely here" | Document the specific architectural control that prevents pivoting and verify that it is implemented. |
| "This threat actor would not target this" | Document the basis for that exclusion. You must always consider insider threats and supply chain actors. |