From 77c538bc9560201721217e815704b07a6655c106 Mon Sep 17 00:00:00 2001 From: alexjackson-coderabbit Date: Sun, 6 Sep 2026 15:58:07 +0100 Subject: [PATCH 1/2] Updated pre-merge checks Added new industry checks, updated existing checks, and added a README so customers can start implementing them more easily. --- README.md | 8 +++ .../.coderabbit-data-privacy.yaml | 2 +- .../pre-mergechecks/.coderabbit-fintech.yaml | 24 +++++++ .../.coderabbit-health-tech.yaml | 24 +++++++ .../.coderabbit-infrastructure.yaml | 2 +- .../.coderabbit-multi-tenant-saas.yaml | 24 +++++++ .../.coderabbit-performance.yaml | 2 +- .../pre-mergechecks/.coderabbit-security.yaml | 6 +- configs/pre-mergechecks/README.md | 64 +++++++++++++++++++ 9 files changed, 150 insertions(+), 6 deletions(-) create mode 100644 configs/pre-mergechecks/.coderabbit-fintech.yaml create mode 100644 configs/pre-mergechecks/.coderabbit-health-tech.yaml create mode 100644 configs/pre-mergechecks/.coderabbit-multi-tenant-saas.yaml create mode 100644 configs/pre-mergechecks/README.md diff --git a/README.md b/README.md index 4de0fd0..3793a23 100644 --- a/README.md +++ b/README.md @@ -10,6 +10,7 @@ This curated list covers the best resources, tutorials, and community content re - [Getting Started](#getting-started) - [API Reference](#api-reference) - [Configuration Examples](#configuration-examples) +- [Pre-Merge Check Packs](#pre-merge-check-packs) - [Integration Guides](#integration-guides) - [Video Tutorials](#video-tutorials) - [Blogs](#blogs) @@ -90,6 +91,13 @@ configs/ └── multi-language/ # Full-stack project configurations ``` +## Pre-Merge Check Packs + +The [pre-merge check catalog](configs/pre-mergechecks/README.md) contains +copyable policy examples for common engineering risks, multi-tenant SaaS, +fintech, and health tech. It explains how to select, adapt, and safely introduce +individual checks without replacing existing repository configuration. + ## Integration Guides diff --git a/configs/pre-mergechecks/.coderabbit-data-privacy.yaml b/configs/pre-mergechecks/.coderabbit-data-privacy.yaml index 269575e..7caa2f7 100644 --- a/configs/pre-mergechecks/.coderabbit-data-privacy.yaml +++ b/configs/pre-mergechecks/.coderabbit-data-privacy.yaml @@ -11,4 +11,4 @@ reviews: - name: "Deployment-Ready Config Verification" mode: "error" instructions: >- - When production configuration files are modified, review all new or modified values in those files. Fail if any value contains a placeholder such as `TBD`, `PLACEHOLDER`, `TODO`, `REPLACE_ME`, or an empty string where a real value is required. Fail if required identifiers (workflow IDs, service endpoints, ARNs, connection strings) are not populated with real values. Fail if configuration key names are inconsistent across environments (the same logical setting using different key names in staging vs. production). Pass only when all production configuration values are real, consistent, and deployment-ready. + When production configuration files are modified, review all new or modified values in those files. Fail if any value contains a placeholder such as `TBD`, `PLACEHOLDER`, `TODO`, `REPLACE_ME`, or an empty string where a real value is required. Do not flag environment-variable, secret-manager, or template references that are intentionally resolved during deployment. Fail if required identifiers (workflow IDs, service endpoints, ARNs, connection strings) are neither populated nor supplied through one of those mechanisms. Fail if configuration key names are inconsistent across environments. Pass only when production configuration is consistent and deployment-ready. diff --git a/configs/pre-mergechecks/.coderabbit-fintech.yaml b/configs/pre-mergechecks/.coderabbit-fintech.yaml new file mode 100644 index 0000000..e19a10c --- /dev/null +++ b/configs/pre-mergechecks/.coderabbit-fintech.yaml @@ -0,0 +1,24 @@ +# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json +language: "en-US" +reviews: + pre_merge_checks: + custom_checks: + - name: "Use Exact Monetary Arithmetic" + mode: "warning" + instructions: >- + When changed code stores, parses, calculates, or compares monetary amounts, fail if it uses binary floating-point values without converting immediately to an exact money representation. Require integer minor units, a decimal type, or the repository's established money type, with currency and rounding behavior explicit at conversion boundaries. Pass when calculations use an exact representation throughout. Mark not applicable for display-only formatting of an already exact amount and for changes that do not handle money. + + - name: "Make Financial Effects Idempotent" + mode: "warning" + instructions: >- + When changed code creates a charge, refund, payout, transfer, ledger entry, invoice payment, or financial-webhook side effect, fail if retrying the same logical operation can create a duplicate effect. Verify a stable idempotency key, provider event ID, or persisted deduplication record is checked at the side-effect boundary. An in-memory flag is insufficient. Pass when the provider call and local state transition are protected by a durable idempotency mechanism. Mark not applicable for read-only financial operations. + + - name: "Keep Financial Secrets Out of Output" + mode: "warning" + instructions: >- + When changed code emits logs, analytics, errors, traces, or API responses involving financial data, fail if it can expose a full card number, card verification code, bank-account credential, payment-provider secret, or unredacted provider request containing those values. Masking must occur before the value reaches the output call. Pass when only approved tokens, non-sensitive identifiers, or masked values are emitted. Mark not applicable when the PR does not handle financial data or observable output. + + - name: "Audit Financial State Transitions" + mode: "warning" + instructions: >- + When changed code transitions a payment, refund, payout, transfer, invoice, or ledger entry between business states, fail if it bypasses the repository's existing durable audit or domain-event mechanism. Verify the recorded event identifies the affected entity, transition, initiating actor or system, and correlation or provider event ID without including sensitive financial credentials. Pass when the existing audit mechanism is invoked with those fields. Mark not applicable when no financial state transition is added or modified, or when the repository has no established audit mechanism to enforce. diff --git a/configs/pre-mergechecks/.coderabbit-health-tech.yaml b/configs/pre-mergechecks/.coderabbit-health-tech.yaml new file mode 100644 index 0000000..c7da159 --- /dev/null +++ b/configs/pre-mergechecks/.coderabbit-health-tech.yaml @@ -0,0 +1,24 @@ +# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json +language: "en-US" +reviews: + pre_merge_checks: + custom_checks: + - name: "Keep Health Data Out of Telemetry" + mode: "warning" + instructions: >- + When changed code sends values to logs, traces, metrics, analytics, or error-reporting services, fail if a value can contain protected health information such as patient identity, medical record numbers, diagnoses, medications, test results, appointment details, or raw clinical content. Masking or removal must happen before the telemetry call. Pass when only approved non-sensitive identifiers or masked values are emitted. Mark not applicable when the PR does not change telemetry involving health data. + + - name: "Authorize Patient Record Access" + mode: "warning" + instructions: >- + When a changed API handler, resolver, command, or service reads or mutates a patient or clinical record using an identifier from a request or message, fail if it does not verify that the authenticated principal is permitted to access that specific record. Authentication alone is insufficient. Trace calls to existing guards or policy helpers and verify their behavior before passing. Pass when access is constrained by a verified patient relationship, care-team role, tenant scope, or explicit record policy. Mark not applicable for public reference data and changes that do not access patient records. + + - name: "Minimize Health Data Responses" + mode: "warning" + instructions: >- + When changed server-side code returns patient or clinical data through an API, export, webhook, or third-party integration, fail if it serializes the full persistence model or removes sensitive fields with a denylist. Require an explicit response schema, projection, or allowlist containing only fields needed by that recipient. Pass when output fields are explicitly selected and authorization is applied before serialization. Mark not applicable when no health-data response or disclosure path is added or modified. + + - name: "Audit Clinical Record Changes" + mode: "warning" + instructions: >- + When changed code creates, updates, deletes, or exports patient or clinical records, fail if it bypasses the repository's existing durable audit mechanism. Verify the audit event identifies the acting user or system, affected record or patient identifier, action, timestamp or correlation ID, and outcome without recording raw clinical content. Pass when the established audit mechanism is invoked with those fields. Mark not applicable when no clinical-record operation is added or modified, or when the repository has no established audit mechanism to enforce. diff --git a/configs/pre-mergechecks/.coderabbit-infrastructure.yaml b/configs/pre-mergechecks/.coderabbit-infrastructure.yaml index 1c5a504..8e3eb6c 100644 --- a/configs/pre-mergechecks/.coderabbit-infrastructure.yaml +++ b/configs/pre-mergechecks/.coderabbit-infrastructure.yaml @@ -6,7 +6,7 @@ reviews: - name: "IaC Template Version Integrity" mode: "error" instructions: >- - When infrastructure-as-code templates (CloudFormation, Terraform modules, Chef cookbooks, Helm charts, Ansible roles) are modified, and functional sections of an IaC template are changed (resources, parameters, outputs, recipes, tasks, or equivalent—not comments or metadata-only fields), the template's version identifier must be incremented. Verify that the version field exists in the modified template and that its value has changed compared to the base branch. Fail if functional changes are present but the version is unchanged. Pass when the version is incremented for any functional change, or when only comments or documentation are modified. + When infrastructure-as-code templates (CloudFormation, Terraform modules, Chef cookbooks, Helm charts, Ansible roles) are modified, and functional sections of an IaC template are changed (resources, parameters, outputs, recipes, tasks, or equivalent—not comments or metadata-only fields), enforce version increments only when that template or repository already uses an explicit version field or documented versioning convention. Fail if functional changes are present but the established version is unchanged. Pass when it is incremented or only comments or documentation are modified. Mark not applicable when no version identifier or convention exists. - name: "Chart Dependency Lock Consistency" mode: "warning" diff --git a/configs/pre-mergechecks/.coderabbit-multi-tenant-saas.yaml b/configs/pre-mergechecks/.coderabbit-multi-tenant-saas.yaml new file mode 100644 index 0000000..6180571 --- /dev/null +++ b/configs/pre-mergechecks/.coderabbit-multi-tenant-saas.yaml @@ -0,0 +1,24 @@ +# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json +language: "en-US" +reviews: + pre_merge_checks: + custom_checks: + - name: "Require Tenant-Scoped Data Access" + mode: "warning" + instructions: >- + When changed server-side code reads or mutates tenant-owned records, fail if the operation can select records by a resource ID or other global criteria without also constraining access to the authenticated tenant or an explicitly authorized cross-tenant scope. A tenant ID supplied only by the request is not proof of authorization; verify it is matched to trusted authentication context or an existing authorization policy. Pass when every applicable operation is tenant-scoped or calls a verified central policy that enforces the same constraint. Mark not applicable when the PR does not access tenant-owned data or the affected data is explicitly global. + + - name: "Partition Tenant Cache Entries" + mode: "warning" + instructions: >- + When changed code reads or writes cached tenant-owned data, fail if the cache key or cache namespace does not include a trusted tenant identifier. Also fail when tenant context is added to a data lookup but the corresponding cache key remains globally shared. Pass when the key is visibly tenant-partitioned or when a referenced cache helper can be verified to add the tenant namespace. Mark not applicable for public, immutable, or explicitly global data and for changes that do not use a cache. + + - name: "Authorize Privileged Tenant Changes" + mode: "warning" + instructions: >- + When a changed handler or service can alter tenant membership, roles, permissions, billing settings, security settings, or tenant ownership, fail if no authorization check is executed before the mutation. Verify the check by following calls to existing middleware, guards, or policy helpers; do not accept a function name as evidence without inspecting its behavior. Pass when the code requires an appropriate privileged role or a verified central policy. Mark not applicable when the PR does not add or modify a privileged tenant operation. + + - name: "Scope Asynchronous Tenant Work" + mode: "warning" + instructions: >- + When changed producers or consumers enqueue, receive, or process work for tenant-owned resources, fail if the message lacks trusted tenant context or if the consumer loads the resource without verifying that it belongs to that tenant before causing side effects. Pass when both message context and resource access are tenant-scoped, or when the referenced job framework can be verified to enforce tenant scope centrally. Mark not applicable for global jobs and changes that do not process tenant-owned resources asynchronously. diff --git a/configs/pre-mergechecks/.coderabbit-performance.yaml b/configs/pre-mergechecks/.coderabbit-performance.yaml index 5a74421..def9f81 100644 --- a/configs/pre-mergechecks/.coderabbit-performance.yaml +++ b/configs/pre-mergechecks/.coderabbit-performance.yaml @@ -6,4 +6,4 @@ reviews: - name: "Runtime Efficiency and Scaling Review" mode: "error" instructions: >- - Review changed code for material performance regressions. Flag O(n²) or worse behavior in any path that processes non-trivially sized input, including request handlers, background jobs, rendering paths, and collection iteration. Flag N+1 query patterns—database or external service calls inside a loop that should be batched, joined, or preloaded. Flag repeated recomputation of deterministic values inside loops where caching, memoization, or pre-computation outside the loop would eliminate redundant work. Flag inefficient data structure choices such as linear-search arrays for membership checks where a hash set is appropriate. Flag unbounded data accumulation, missing pagination, or caches without eviction. Flag expensive synchronous work (compression, hashing, template rendering) in hot paths where it should be deferred or sampled. Report only issues that could materially degrade latency, throughput, or resource usage at realistic input sizes—ignore micro-optimizations and speculative concerns. + Review changed code for material performance regressions. Flag O(n²) or worse behavior in paths that process non-trivially sized input. Flag N+1 query patterns—database or external service calls inside a loop that should be batched, joined, or preloaded. Flag repeated recomputation of deterministic values inside loops where caching or pre-computation would eliminate redundant work. Flag inefficient data structure choices such as linear-search arrays for membership checks where a hash set is appropriate. Flag unbounded data accumulation, missing pagination, or caches without eviction. Flag expensive synchronous work (compression, hashing, template rendering) in hot paths where it should be deferred or sampled. Report only issues that could materially degrade latency, throughput, or resource usage at realistic input sizes; ignore micro-optimizations and speculative concerns. diff --git a/configs/pre-mergechecks/.coderabbit-security.yaml b/configs/pre-mergechecks/.coderabbit-security.yaml index ee6d70c..8b52dfe 100644 --- a/configs/pre-mergechecks/.coderabbit-security.yaml +++ b/configs/pre-mergechecks/.coderabbit-security.yaml @@ -6,7 +6,7 @@ reviews: - name: "Query Parameterization Enforcement" mode: "error" instructions: >- - Review all new or modified database query construction. Fail if any query is built by concatenating or interpolating user-supplied input directly into a SQL string. Use parameterized queries or prepared statements with placeholders for all external values. Reuse prepared statements for repeated queries rather than rebuilding them per call. Flag any string-building approach to query construction and require it to be replaced with parameterized equivalents before merging. + Review all new or modified database query construction. Fail if a query is built by concatenating or interpolating user-supplied or otherwise untrusted input directly into executable query text. Use parameterized queries or prepared statements with placeholders for external values. Do not flag composition from fixed, code-defined fragments or identifiers selected through a strict allowlist. Reuse prepared statements for repeated queries rather than rebuilding them per call. Pass when no untrusted value can alter query structure. - name: "Sensitive Output Leak Prevention" mode: "error" @@ -16,12 +16,12 @@ reviews: - name: "Top Vulnerability Pattern Audit" mode: "warning" instructions: >- - Review all changed code against the OWASP Top 10 for Web (2021) and API Security (2023). Flag broken access control (missing authorization checks, insecure direct object references, privilege escalation paths); cryptographic failures (hardcoded secrets, weak algorithms such as MD5/SHA1/DES, unencrypted sensitive data in transit or at rest); injection vulnerabilities (SQL, NoSQL, OS command, or expression-language injection via unsanitized input); security misconfiguration (default credentials, verbose error messages exposing stack traces, permissive IAM policies); vulnerable or outdated components with published CVEs; identification and authentication failures (weak session management, improper token validation); and SSRF (user-controlled URLs passed to server-side HTTP requests without allowlisting). For API endpoints, additionally flag broken object-level authorization, unrestricted resource consumption without rate limiting or pagination, and over-fetching of sensitive fields in responses. Post each finding as a comment on the affected line with a brief remediation note. + Review changed code against the OWASP Top 10 for Web (2021) and API Security (2023). Flag broken access control; hardcoded secrets, weak cryptography, or unencrypted sensitive data; SQL, NoSQL, command, or expression-language injection; default credentials, verbose errors, or permissive IAM; dependencies with applicable published CVEs; weak session management or token validation; and user-controlled URLs passed to server-side requests without allowlisting. For APIs, also flag missing object-level authorization, unrestricted resource consumption without rate limits or pagination, and over-fetching of sensitive response fields. Report only evidence found in changed code and include a brief remediation in the check summary. - name: "Dependency Risk Assessment" mode: "warning" instructions: >- - When dependency manifests (package.json, pom.xml, requirements.txt, go.mod, Gemfile, etc.) are modified, review newly added or upgraded third-party libraries. Flag any dependency with known security vulnerabilities in public advisory databases. Flag libraries with non-permissive licenses (e.g., AGPL, GPL) when the project requires permissive licenses (e.g., MIT, Apache 2.0). Pay particular attention to libraries that handle authentication, payments, healthcare data, or cryptography. Require explicit justification in the PR description for any dependency that introduces significant legal or security risk. + When dependency manifests or lock files are modified, review newly added or upgraded third-party libraries. Flag a security vulnerability only after verifying that a public advisory applies to the direct or resolved transitive version; return inconclusive when the version or affected range cannot be established. Flag non-permissive licenses (e.g., AGPL, GPL) only when the repository documents a permissive-license policy. Pay particular attention to libraries handling authentication, payments, health data, or cryptography. Require PR justification for a verified legal or security risk. - name: "Personal Data Exposure Guard" mode: "error" diff --git a/configs/pre-mergechecks/README.md b/configs/pre-mergechecks/README.md new file mode 100644 index 0000000..42a6125 --- /dev/null +++ b/configs/pre-mergechecks/README.md @@ -0,0 +1,64 @@ +# Start here: Pre-Merge Checks + +Pre-merge checks answer one question before code lands: **Does this pull request +meet our standards?** CodeRabbit evaluates them whenever a pull request opens or +updates and reports a pass, failure, or inconclusive result with an explanation. + +This folder contains ready-to-adapt packs for common engineering and industry +risks. They are starting points, not universal rules or compliance +certifications. + +## Use a pack + +1. Enable CodeRabbit's built-in checks for PR titles, descriptions, linked issue + alignment, and docstring coverage where they fit your workflow. +2. Browse the packs and select only the individual checks that match your + policies. Mix checks from different files as needed. +3. Adapt their paths, terminology, exceptions, and enforcement modes to the + repository. +4. Add selected checks in **Settings → Pre-merge checks**, or copy their entries + into `reviews.pre_merge_checks.custom_checks` in the existing + `.coderabbit.yaml`. Do not replace unrelated configuration. +5. Consider starting copied checks in `warning` mode while the team evaluates + false positives and inconclusive results. Promote a check to `error` only + after it is reliable for that repository. Blocking also requires + request-changes workflow. + +Test before saving with +`@coderabbitai evaluate custom pre-merge check --name --instructions --mode warning`. +Run all configured checks with `@coderabbitai run pre-merge checks`. + +## Available packs + +| Pack | Best for | Primary outcome | +| --- | --- | --- | +| [Security](.coderabbit-security.yaml) | Applications accepting external input or changing dependencies | Prevent injection, exposed credentials, broken object authorization, and dependency risk | +| [Multi-Tenant SaaS](.coderabbit-multi-tenant-saas.yaml) | Services that store or process customer data in shared systems | Prevent cross-tenant reads, writes, cache collisions, and background-job effects | +| [Fintech & Payments](.coderabbit-fintech.yaml) | Banking, checkout, billing, payout, ledger, and payment-integration code | Protect monetary correctness, retry safety, financial data, and transaction auditability | +| [Health Tech](.coderabbit-health-tech.yaml) | Applications that store, expose, or process patient and clinical data | Protect health data, record authorization, minimum-necessary responses, and auditability | +| [Infrastructure](.coderabbit-infrastructure.yaml) | Teams reviewing infrastructure, deployment, and product-readiness concerns | Check IaC versions, Helm locks, analytics, accessibility, and debug output | +| [Data Privacy](.coderabbit-data-privacy.yaml) | Teams shipping data pipelines and production configuration | Check pipeline validation and deployment-ready configuration | +| [Performance](.coderabbit-performance.yaml) | Applications with latency, throughput, or scaling concerns | Surface material algorithmic, query, allocation, and hot-path regressions | +| [PR Hygiene](.coderabbit-pr-hygiene.yaml) | Teams standardizing change communication | Surface breaking changes, missing design context, and stale documentation | +| [Testing](.coderabbit-testing.yaml) | Repositories where behavior changes require reviewable evidence | Check proportionate coverage, test isolation, and validation evidence | +| [Quality](.coderabbit-quality.yaml) | Teams enforcing shared implementation conventions | Check API consistency, error handling, imports, naming, and commit conventions | + +## Know the boundaries + +Custom checks inspect a secure, read-only workspace. They do not run the test +suite or build, inspect generated build artifacts, verify reviewer approvals, or +post inline review comments. Use CI, branch protection, and normal CodeRabbit +review instructions for those responsibilities. + +See the CodeRabbit documentation for [built-in +checks](https://docs.coderabbit.ai/pr-reviews/pre-merge-checks) and [writing +custom checks](https://docs.coderabbit.ai/pr-reviews/custom-checks). + +## Industry packs are safeguards, not certifications + +An industry pack maps common engineering risks into checks that can be supported +by pull-request evidence. It cannot determine whether an organization complies +with a regulation or standard whose controls also cover people, processes, +runtime systems, vendors, and operations. Validate proposed checks with the +customer's security, privacy, and compliance owners before using them as merge +blockers. From 55112f31622fdbddcc04195ed1ba087748b94759 Mon Sep 17 00:00:00 2001 From: alexjackson-coderabbit Date: Sun, 6 Sep 2026 16:19:17 +0100 Subject: [PATCH 2/2] CR suggestions implemented --- configs/pre-mergechecks/.coderabbit-fintech.yaml | 2 +- configs/pre-mergechecks/.coderabbit-health-tech.yaml | 2 +- configs/pre-mergechecks/.coderabbit-multi-tenant-saas.yaml | 2 +- configs/pre-mergechecks/.coderabbit-security.yaml | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/configs/pre-mergechecks/.coderabbit-fintech.yaml b/configs/pre-mergechecks/.coderabbit-fintech.yaml index e19a10c..d9da2b4 100644 --- a/configs/pre-mergechecks/.coderabbit-fintech.yaml +++ b/configs/pre-mergechecks/.coderabbit-fintech.yaml @@ -6,7 +6,7 @@ reviews: - name: "Use Exact Monetary Arithmetic" mode: "warning" instructions: >- - When changed code stores, parses, calculates, or compares monetary amounts, fail if it uses binary floating-point values without converting immediately to an exact money representation. Require integer minor units, a decimal type, or the repository's established money type, with currency and rounding behavior explicit at conversion boundaries. Pass when calculations use an exact representation throughout. Mark not applicable for display-only formatting of an already exact amount and for changes that do not handle money. + When changed code stores, parses, calculates, or compares monetary amounts, fail if it uses binary floating-point values or constructs an exact decimal type directly from a float or double, such as `BigDecimal(double)` or `Decimal(float)`. Precision may already be lost before conversion. Require decimal-string parsing, integer minor units, or the repository's established money type, with currency and rounding behavior explicit at conversion boundaries. Pass when calculations use an exact representation throughout. Mark not applicable for display-only formatting of an already exact amount and for changes that do not handle money. - name: "Make Financial Effects Idempotent" mode: "warning" diff --git a/configs/pre-mergechecks/.coderabbit-health-tech.yaml b/configs/pre-mergechecks/.coderabbit-health-tech.yaml index c7da159..2da16d2 100644 --- a/configs/pre-mergechecks/.coderabbit-health-tech.yaml +++ b/configs/pre-mergechecks/.coderabbit-health-tech.yaml @@ -11,7 +11,7 @@ reviews: - name: "Authorize Patient Record Access" mode: "warning" instructions: >- - When a changed API handler, resolver, command, or service reads or mutates a patient or clinical record using an identifier from a request or message, fail if it does not verify that the authenticated principal is permitted to access that specific record. Authentication alone is insufficient. Trace calls to existing guards or policy helpers and verify their behavior before passing. Pass when access is constrained by a verified patient relationship, care-team role, tenant scope, or explicit record policy. Mark not applicable for public reference data and changes that do not access patient records. + When a changed API handler, resolver, command, or service reads or mutates a patient or clinical record using an identifier from a request or message, fail if it does not verify that the authenticated principal is permitted to access that specific record. Authentication and tenant scope alone are insufficient. Trace calls to existing guards or policy helpers and verify their behavior before passing. Pass when tenant scope is enforced where applicable and record access is authorized through a verified patient relationship, care-team role, or explicit record policy. Mark not applicable for public reference data and changes that do not access patient records. - name: "Minimize Health Data Responses" mode: "warning" diff --git a/configs/pre-mergechecks/.coderabbit-multi-tenant-saas.yaml b/configs/pre-mergechecks/.coderabbit-multi-tenant-saas.yaml index 6180571..9d7c431 100644 --- a/configs/pre-mergechecks/.coderabbit-multi-tenant-saas.yaml +++ b/configs/pre-mergechecks/.coderabbit-multi-tenant-saas.yaml @@ -11,7 +11,7 @@ reviews: - name: "Partition Tenant Cache Entries" mode: "warning" instructions: >- - When changed code reads or writes cached tenant-owned data, fail if the cache key or cache namespace does not include a trusted tenant identifier. Also fail when tenant context is added to a data lookup but the corresponding cache key remains globally shared. Pass when the key is visibly tenant-partitioned or when a referenced cache helper can be verified to add the tenant namespace. Mark not applicable for public, immutable, or explicitly global data and for changes that do not use a cache. + When changed code reads or writes cached tenant-owned data, fail if the cache key or namespace omits the trusted tenant identifier or another trusted authorization dimension that changes the cached value, such as user, role, delegated scope, or resource permissions. Do not require access-control dimensions that affect only whether a caller may read an otherwise identical value. Pass when the key includes every dimension that changes the value, a verified cache helper adds them, or sharing is explicitly intentional. Mark not applicable for public, immutable, explicitly global, or non-cached data. - name: "Authorize Privileged Tenant Changes" mode: "warning" diff --git a/configs/pre-mergechecks/.coderabbit-security.yaml b/configs/pre-mergechecks/.coderabbit-security.yaml index 8b52dfe..e89c9a8 100644 --- a/configs/pre-mergechecks/.coderabbit-security.yaml +++ b/configs/pre-mergechecks/.coderabbit-security.yaml @@ -6,7 +6,7 @@ reviews: - name: "Query Parameterization Enforcement" mode: "error" instructions: >- - Review all new or modified database query construction. Fail if a query is built by concatenating or interpolating user-supplied or otherwise untrusted input directly into executable query text. Use parameterized queries or prepared statements with placeholders for external values. Do not flag composition from fixed, code-defined fragments or identifiers selected through a strict allowlist. Reuse prepared statements for repeated queries rather than rebuilding them per call. Pass when no untrusted value can alter query structure. + Review all new or modified database query construction. Fail if a query is built by concatenating or interpolating user-supplied or otherwise untrusted input directly into executable query text. Use parameterized queries or prepared statements with placeholders for external values. Do not flag composition from fixed, code-defined fragments or identifiers selected through a strict allowlist. Pass when no untrusted value can alter query structure. - name: "Sensitive Output Leak Prevention" mode: "error" @@ -21,7 +21,7 @@ reviews: - name: "Dependency Risk Assessment" mode: "warning" instructions: >- - When dependency manifests or lock files are modified, review newly added or upgraded third-party libraries. Flag a security vulnerability only after verifying that a public advisory applies to the direct or resolved transitive version; return inconclusive when the version or affected range cannot be established. Flag non-permissive licenses (e.g., AGPL, GPL) only when the repository documents a permissive-license policy. Pay particular attention to libraries handling authentication, payments, health data, or cryptography. Require PR justification for a verified legal or security risk. + When dependency manifests, constraints, or lock files are modified, review every changed direct and resolved transitive dependency version, including additions, upgrades, and downgrades. Flag a security vulnerability only after verifying that a public advisory applies to the resolved version; return inconclusive when the version or affected range cannot be established. Flag non-permissive licenses (e.g., AGPL, GPL) only when the repository documents a permissive-license policy. Pay particular attention to libraries handling authentication, payments, health data, or cryptography. Require PR justification for a verified legal or security risk. - name: "Personal Data Exposure Guard" mode: "error"