# Sensitive Code

## Purpose

Sensitive Code defines code and diff patterns that require elevated review. It is not a secret scanner and must not contain real secrets.

Use this rule when a change may affect confidentiality, integrity, availability, identity boundaries, execution boundaries, production safety, or security evidence.

Sensitive code changes must trigger stricter AI review or human review.

## Trigger Categories

### 1. Plaintext Sensitive Information

Trigger when a diff adds, modifies, moves, logs, or exposes:

- API keys, tokens, private keys, passwords, certificates
- `.env`, config secrets, credentials, connection strings
- real accounts, internal URLs, production endpoints
- service credentials or cloud/provider credentials

Escalate to: `secrets-and-credentials-review`

### 2. Credential Handling Code

Trigger when code reads, caches, refreshes, forwards, serializes, prints, stores, rotates, or deletes secrets.

Examples:

- `process.env`
- secret manager clients
- token refresh logic
- credential cache
- secret masking / redaction
- logs containing auth headers or tokens

Required evidence:

- file and line
- secret source
- secret sink
- masking/rotation behavior
- command or test used to verify no leakage

### 3. Identity and Permission Boundaries

Trigger when code changes:

- authentication
- authorization
- role / permission checks
- owner/admin checks
- session, cookie, JWT, OAuth, OIDC
- middleware enforcing access control

Escalate to: `auth-boundary-review`

Required evidence:

- protected resource
- actor/user role
- permission check location
- bypass path considered
- negative test or proof

### 4. Sensitive Data Surface

Trigger when code handles:

- PII
- user-generated content
- logs containing user/session data
- export/delete/retention flows
- backup/restore
- analytics or telemetry
- data masking or redaction

Escalate to: `privacy-data-review`

Required evidence:

- data class
- storage location
- retention/delete behavior
- redaction behavior
- affected users or scope

### 5. Execution Boundaries

Trigger when code invokes or modifies:

- shell/process execution
- dynamic code execution
- plugin execution
- agent/tool calls
- filesystem read/write/delete
- network requests
- sandbox permissions or bypass paths
- webhook/callback URLs

Escalate to: `execution-boundary-review`

Required evidence:

- source of input
- execution sink
- allowlist/denylist behavior
- sandbox boundary
- failure mode
- test command

### 6. Cryptography and Signatures

Trigger when code changes:

- encryption/decryption
- signing/verification
- JWT handling
- webhook signature verification
- hashing
- nonce/random generation
- key rotation or key storage

Escalate to: `crypto-signature-review`

Required evidence:

- algorithm/library
- key source
- verification path
- replay/expiry behavior
- backward compatibility impact

### 7. Release and Supply Chain

Trigger when code changes:

- CI/CD workflows
- release scripts
- install scripts
- dependency update paths
- package manager scripts
- Docker/build files
- generated artifacts
- provenance/signing/attestation
- GitHub Actions permissions or secrets

Escalate to: `supply-chain-release-review`

Required evidence:

- workflow entrypoint
- token permissions
- secret access
- third-party actions/dependencies
- artifact produced
- release path affected

### 8. Destructive or Production-Affecting Operations

Trigger when code can:

- delete data
- run migrations
- perform bulk updates
- change production flags
- elevate privileges
- disable safety checks
- modify backups or restore paths
- change admin-only operations

Escalate to: `destructive-change-review`

Required evidence:

- affected data/resource
- blast radius
- rollback plan
- dry-run/staging result
- approval requirement
- monitoring or alerting evidence

## Review Escalation Rules

A change is sensitive if any of the following is true:

1. It touches a known sensitive path.
2. It introduces a sensitive keyword or sink.
3. It changes a trust boundary.
4. It changes credential, auth, data, execution, crypto, CI/CD, or destructive behavior.
5. It weakens validation, authorization, logging redaction, sandboxing, or review requirements.
6. It adds generated, obfuscated, minified, vendored, or binary content to a release path.
7. It changes code that controls production behavior.

## Required Output

For every sensitive-code finding, the reviewer must output:

- category
- severity
- trigger reason
- file and line
- diff evidence
- affected boundary or asset
- required follow-up skill/reviewer
- command/test/evidence required before merge
- whether human review is mandatory

## Non-Goals

This file does not:

- store actual secrets
- replace gitleaks, trufflehog, GitHub secret scanning, or SAST
- prove exploitability by itself
- automatically approve security-sensitive changes

It classifies sensitive changes and routes them to stricter review.