every suite.
- If adding policy behavior, add/update Bats coverage for the public contract or security boundary that changed.
- Keep `.sb` header comments and any `#safehouse-test-id:*#` markers used
invoked directly.
Next.js documentation explicitly states: "Treat Server Actions with the same security considerations as public-facing API endpoints, and verify if the user is allowed to perform a mutation
server: `src/cascadia/WindowsTerminal/TerminalProtocolComServer.cpp`
Do not treat `WT_COM_CLSID`, `pipe-id`, or `set-env` as security boundaries.
The human-facing WTA CLI intentionally does not expose direct keystroke
injection; internal `ShellManager
token**: `Library/McpUnity/bridge-token` (256-bit hex secret; never commit or copy into project settings).
- **Handshake security**: clients authenticate as `mcp-unity: ` with HTTP Basic and must omit `Origin`; every supplied Origin
features they enable, such as pod
labels, pod UID, virtual GPU mapping, or DRA.
- Security context changes are user-visible. Preserve the documented
SYS_ADMIN/profiling tradeoff unless deliberately changing
this library provides both protected-resource middleware and the authorization server functionality needed to secure them.
This library was largely written with Claude AI assistance, with all code thoroughly reviewed
from specifications requires specific tools and workflows (see [code generation docs](https://github.com/Azure/azure-sdk-for-go/blob/main/documentation/development/generate.md))
#### Security and Compliance
- **Security issues**: Must be reported privately to <secure@microsoft.com>, not in public issues
- **License
grouped
under `src/components/`, with shared React hooks in `src/hooks/`. Shared domain
logic, provider adapters,
security gates,
and API helpers live in `src/lib/`; client service wrappers are in
`src/services/`; persisted Zustand
loop before hypothesizing. |
Warden's automated PR review and `agents.toml` also pull **remote** specialists (`security-review`, `gha-security-review`, `span-convention-review`, and more) — invoke those for depth beyond