Scheduled security scans with evidence and PR gates

Scheduled security work combines deterministic scanners with a separately scoped agent pass. The agent can trace authorization, tenant isolation, trust boundaries, and business logic that pattern-based tools may miss, but every finding remains untrusted until reproduced or reviewed. Initial runs are read-only; accepted patches use an isolated branch, CI evidence, and a security-owner PR gate.

Scorecard question: How do you scan the codebase for deep vulnerabilities and architectural drift?

Maximum-score answer: Scheduled scanner and agent passes retain evidence, route suggested patches through PR gates, and add regression evals for accepted fixes.

The layered scan

Layer	Finds	Required evidence
Dependency, secret, and SAST scanners	Known vulnerable versions, leaked secrets, code patterns	Tool version, rule ID, file and line
Agent analysis	Cross-file authorization, tenant isolation, unsafe state transitions	Trace through concrete call sites and tests
Human security triage	Exploitability, business impact, remediation priority	Accept/reject decision with owner and rationale
Regression suite	Recurrence of an accepted vulnerability	Failing-before, passing-after test

Do not let the model replace SAST, dependency scanning, secret detection, penetration tests, or threat modeling. Do not let a low-confidence narrative open a flood of patches.

Safe scheduled job contract

A scheduler may be CI, a supported cloud-agent feature, or an internal runner. Give it:

a dedicated read-only identity for the first pass;
an explicit repository/ref and time limit;
no production secrets or live customer-data access;
an output schema and finding cap;
retention rules for code excerpts and telemetry;
a route to triage, not direct merge or deploy.

task: scheduled-security-review
ref: default-branch
mode: read-only
max_findings: 10
focus: [authorization, tenant-isolation, injection, secrets, race-conditions]
output: security-findings.json
on_accept:
  create_isolated_branch: true
  require: [regression-test, ci, security-owner-review]
forbidden: [production-access, exploit-live-target, direct-merge, deploy]

This is a tool-neutral contract, not a vendor configuration file.

Prompts to copy

Review the repository read-only for authorization, tenant isolation,
injection, secret exposure, and unsafe state transitions.
For each candidate cite file and line, trace the reachable path,
state missing evidence, and propose a safe reproduction test.
Do not exploit live systems, edit files, or report more than 10 findings.

For the accepted finding FINDING_ID, add a failing regression test first
in an isolated branch. Then propose the smallest patch.
Run the repository security and test gates; return commands, exit codes,
remaining risk, and the human security owner required before merge.

Failure modes

Confidence is treated as validation. A model’s confidence score is not proof. Require a trace, safe reproduction, deterministic tool output, or specialist review.

The scan can reach production. Remove credentials and network routes before tuning prompts.

Generated patches change tests to hide the issue. Preserve the failing reproduction and review test changes independently.

Findings repeat every week. Record dispositions with fingerprints and expiration dates; reopen only when the evidence or code changes.

Verify the workflow

Deterministic scanners and the agent pass have recorded versions.
The first pass cannot write to the repository or reach production.
Every finding cites concrete code and labels missing evidence.
Accepted fixes include a regression test and CI output.
A named security owner approves merge for sensitive findings.
Larger remediation generates intent.md and re-enters the lifecycle.

Route accepted work

Use Maintain for scheduling and Deploy for review and release gates.

Q17 · Continuous evals Retain accepted failures as regression cases.

Governance and autonomy Assign identity, evidence, and action tiers.