Security & Compliance Review

A comprehensive security and compliance review framework. Based on input materials and baseline policies, intelligently determines the risk surface and provides actionable remediation recommendations.

For detailed rules and examples, see references/REFERENCE.md.

Execution Flow

Step 0: Pre-Gate — System Type Determination (Blocking)

• Must first determine the system type: Consumer-facing / Internal product / Mixed
• If unable to determine: output a "clarification question" first (blocking conclusion); do not proceed to subsequent checks until the answer is received

Step 1: Relevance Assessment

1. Define scope first: Prioritize MR/diff/specified directory; fall back to scanning the repository
2. Find evidence next: Code/configuration/CI/Helm/dependencies
3. Then draw conclusions: Relevant / Not Relevant (N/A) / Unknown
4. Unknown triggers clarification/blocking only for "must-clarify items"