fail-closed-authz
Review auth, tenancy, entitlement and cache-sharing code against six fail-closed defect classes that ruff and mypy cannot see — four checked mechanically by the bundled security_lint.py, three semantic ones you read against the diff. Every class was a real bug caught by review, not by lint.
Pinned to revision 685376e99ae5, so it is the text this page describes rather than whatever the author pushed since.
Pre-approved tools experimental
Experimental field. Support varies between clients, so this list is what the author declared, not what your client will enforce.
- Read
- Grep
- Glob
- Bash
- PowerShell
- Edit
Files
Every link opens the file at its source, pinned to the revision this page describes.