docs(devsecops): address DTI review feedback (core principles, key exposure) by frameworks-volunteer · Pull Request #616 · security-alliance/frameworks

frameworks-volunteer · 2026-08-30T15:33:33Z

Summary

Addresses review feedback on PR #610 (Developer-Targeted Intrusions).

Two changes based on reviewer suggestions:

Core principles section in overview (suggested by @ElliotFriedman)
- Distills three cross-cutting principles — treat time pressure as a warning sign, verify through multiple channels, and isolate untrusted code — into a quick-reference list
- Reduces cognitive overhead under stress: when there's no time for the full procedure, these are the minimum bar
- Each principle maps to the detailed controls already in the execution-paths and handling pages
Under-pressure callout in handling-untrusted-code (suggested by @ElliotFriedman)
- Adds a brief callout near the top of the procedure linking back to the core principles
- Makes the digestible summary visible right where the checklist lives
Private key / seed phrase coverage in compromise response (suggested by @AllyPry)
- Expands the credential rotation checklist item to explicitly cover wallet private keys and seed phrases
- If the compromised endpoint had access to private keys or seed phrases, revoking the wallet session alone may not prevent theft — assets should be migrated to a newly generated wallet from a clean device

Related to #610.

Attribute DTI authorship to blackbigswan with mattaereal as reviewer. Retain prior IDE authors and add blackbigswan. Add must/should/may wording to the untrusted-code handling procedure.

Use | SEAL on handling-untrusted-code to match sibling DTI pages. Keep DevSecOps overview writers empty for the map-only edit.

Add core principles section to overview (ElliotFriedman's suggestion: distill time pressure, multi-channel verification, and isolation into a quick-reference list to reduce cognitive overhead under stress). Add under-pressure callout to handling-untrusted-code linking to the core principles (ElliotFriedman's suggestion on digestibility). Expand compromise response checklist to cover private key and seed phrase exposure — migrate assets to a new wallet from a clean device (AllyPry's suggestion).

github-actions · 2026-08-30T15:33:45Z

Sidebar Configuration Reminder

This PR includes added, renamed, or removed documentation files:

docs/pages/devsecops/developer-targeted-intrusions/execution-paths.mdx (added)
docs/pages/devsecops/developer-targeted-intrusions/handling-untrusted-code.mdx (added)
docs/pages/devsecops/developer-targeted-intrusions/index.mdx (added)
docs/pages/devsecops/developer-targeted-intrusions/overview.mdx (added)

Please ensure that:

The sidebar in vocs.config.ts has been updated to include these files
New content has the dev: true parameter so it's marked as under development
Sidebar links match the file paths - use the preview deployment to verify

See Contributing Guide – Sidebar & Navigation for more details.

_{This is an automated reminder. If this PR doesn't need sidebar changes, you can ignore this message.}

github-actions · 2026-08-30T15:36:05Z

built with Refined Cloudflare Pages Action

⚡ Cloudflare Pages Deployment

Name	Status	Preview	Last Commit
frameworks	✅ Ready (View Log)	Visit Preview	`ca8db13`

Tighten isolation principle to call out restricted egress and closed ports (ElliotFriedman's razor). Split private-key/seed-phrase migration into its own compromise-response checklist item so operators cannot miss it under a dense rotation bullet (AllyPry). Mirror isolation specifics in the under-pressure callout.

frameworks-volunteer

Model: x-ai/grok-4.5 Reasoning: high Provider: openrouter

Self-review (alternate model vs authoring model)

Authoring commit used glm-5.2; this review uses x-ai/grok-4.5.

Security

Docs-only. No secrets, injection, or unsafe tooling. Credential-free isolation and compromise escalation remain sound. Seed-phrase guidance correctly treats material key exposure as asset migration, not session revoke.

QA vs #610 thread

@ElliotFriedman core principles: present in overview; linked from handling callout.
@ElliotFriedman digestibility under stress: callout + minimum-bar framing; isolation razor now includes restricted egress and closed ports.
@AllyPry private keys / seed phrases: covered; split into its own checklist item so it is not buried.
Frontmatter, internal anchor #core-principles, modality, and CI path look fine.
Pushed clarification commit 61fdc12 on this branch.

Nits (non-blocking)

#616 still carries full #610 file set vs develop (expected until #610 merges). Merge #610 first or accept the combined diff.
Auto-generated index.mdx title still lacks the hyphen used elsewhere (pre-existing).

Verdict

Approve. Feedback addressed; clarifications above are incremental polish only.

mattaereal · 2026-08-30T15:54:52Z

Add Elliot and Allypry and scode as reviewers too (their proper handles), please @frameworks-volunteer

frameworks-volunteer · 2026-08-30T16:12:16Z

Model: glm-5.2 Reasoning: low Provider: openrouter

Added ElliotFriedman, AllyPry, and scode2277 as reviewers on this PR.

Apologies for the delayed response — the mention relay didn't reach me in time.

mattaereal · 2026-08-30T16:15:28Z

@frameworks-volunteer I meant, as reviewers in the yaml structure on the places they added information/reviewed from #610 into this PR

…ntmatter Add YAML contributors.reviewed entries for the reviewers whose security-alliance#610 feedback landed in this PR: - overview: ElliotFriedman (core principles), scode2277 - handling-untrusted-code: ElliotFriedman, AllyPry, scode2277 - execution-paths: scode2277 (approved security-alliance#610) Keep mattaereal; leave wrote as blackbigswan.

frameworks-volunteer · 2026-08-30T16:21:44Z

Model: x-ai/grok-4.5 Reasoning: high Provider: openrouter

Updated frontmatter contributors.reviewed on the pages touched by #610 feedback:

overview.mdx: mattaereal, ElliotFriedman, scode2277
handling-untrusted-code.mdx: mattaereal, ElliotFriedman, AllyPry, scode2277
execution-paths.mdx: mattaereal, scode2277

Commit ca8db13 is on this branch. Sorry for the lag — the reactive spawns for both of your comments failed mid-run (output-length truncation on grok-4.5 high). Details in the CLI thread with mattaereal.

@scode2277

Resolve the overlap @scode2277 raised on security-alliance#600, now that the DTI section has landed via security-alliance#616. Handling Untrusted Code owns the operator procedure, so the five-gate "Screen before execution" section no longer restates it. What remains here are the two decisions that are approvals rather than handling steps: approving dependencies and tools into the allowlist, and comparing model artifacts against reviewed source. Neither is covered by DTI. Adds reciprocal Further reading between this page and the DTI overview, handling-untrusted-code, and execution-paths pages. Claude-Session: https://claude.ai/code/session_01CPQ1FcHGiBKWPd8waT7uGx

mattaereal and others added 7 commits August 20, 2026 19:55

docs(devsecops): add developer-targeted intrusion guidance

914114f

docs(devsecops): fix attribution and strengthen procedure modality

c3f392e

Attribute DTI authorship to blackbigswan with mattaereal as reviewer. Retain prior IDE authors and add blackbigswan. Add must/should/may wording to the untrusted-code handling procedure.

docs(devsecops): align DTI title suffix and drop overview author

5bf6aba

Use | SEAL on handling-untrusted-code to match sibling DTI pages. Keep DevSecOps overview writers empty for the map-only edit.

docs(devsecops): remove blackbigswan from DevSecOps overview attribution

51acb86

chore: retrigger Cloudflare preview deploy

8470784

Remove question related sentence as there are no questions

36e767b

frameworks-volunteer mentioned this pull request Aug 30, 2026

docs(devsecops): add developer-targeted intrusion guidance #610

Closed

6 of 9 tasks

github-actions Bot deployed to Preview August 30, 2026 15:36

View deployment

frameworks-volunteer commented Aug 30, 2026

View reviewed changes

github-actions Bot deployed to Preview August 30, 2026 15:41

View deployment

frameworks-volunteer requested a review from scode2277 August 30, 2026 16:12

mattaereal self-assigned this Aug 30, 2026

mattaereal added the content:add This issue or PR adds content or suggests to label Aug 30, 2026

mattaereal added this to Security Frameworks Aug 30, 2026

github-actions Bot deployed to Preview August 30, 2026 16:24

View deployment

mattaereal merged commit 6fa5dc1 into security-alliance:develop Aug 30, 2026
5 checks passed

github-project-automation Bot moved this to Done in Security Frameworks Aug 30, 2026

frameworks-volunteer deleted the content/developer-targeted-intrusions-review-feedback branch August 30, 2026 16:24

s1ns3nz0 mentioned this pull request Aug 31, 2026

docs(supply-chain): add developer workstation security guidance #600

Closed

5 of 9 tasks

Navigation Menu

Repository navigation

docs(devsecops): address DTI review feedback (core principles, key exposure) - #616

docs(devsecops): address DTI review feedback (core principles, key exposure)#616
mattaereal merged 9 commits into
security-alliance:developfrom
frameworks-volunteer:content/developer-targeted-intrusions-review-feedback

frameworks-volunteer commented Aug 30, 2026

Uh oh!

github-actions Bot commented Aug 30, 2026

Uh oh!

github-actions Bot commented Aug 30, 2026 •

edited

Loading

Uh oh!

frameworks-volunteer left a comment

Uh oh!

mattaereal commented Aug 30, 2026

Uh oh!

frameworks-volunteer commented Aug 30, 2026

Uh oh!

mattaereal commented Aug 30, 2026

Uh oh!

frameworks-volunteer commented Aug 30, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

frameworks-volunteer commented Aug 30, 2026

Summary

Uh oh!

github-actions Bot commented Aug 30, 2026

Sidebar Configuration Reminder

Uh oh!

github-actions Bot commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

built with Refined Cloudflare Pages Action

⚡ Cloudflare Pages Deployment

Uh oh!

frameworks-volunteer left a comment

Choose a reason for hiding this comment

Self-review (alternate model vs authoring model)

Security

QA vs #610 thread

Nits (non-blocking)

Verdict

Uh oh!

mattaereal commented Aug 30, 2026

Uh oh!

frameworks-volunteer commented Aug 30, 2026

Uh oh!

mattaereal commented Aug 30, 2026

Uh oh!

frameworks-volunteer commented Aug 30, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Aug 30, 2026 •

edited

Loading