Risk governance for
AI coding agents

{
  "riskScore": 72,
  "riskLevel": "high",
  "safe": false,
  "summary": "This change modifies authentication middleware to add a
    bypass condition. The bypass allows any request with token 'admin'
    to skip validation, creating a critical auth vulnerability.",
  "reviewFocus": "Authentication bypass in src/auth/middleware.ts:12",
  "keyFindings": [
    "[src/auth/middleware.ts:12] CRITICAL: Hardcoded bypass token
      'admin' allows unauthenticated access to all protected routes.
      This is a backdoor.",
    "[src/auth/middleware.ts:15] HIGH: jwt.verify() called without
      algorithm restriction — vulnerable to algorithm confusion
      attacks (e.g., HS256/RS256 swap)."
  ],
  "inlineComments": [
    {
      "path": "src/auth/middleware.ts",
      "line": 12,
      "body": "Hardcoded bypass — remove this condition entirely.
        Use environment-gated feature flags for test access.",
      "severity": "critical"
    }
  ],
  "agentInstructions": "You are a code editor agent. Address the
    following findings to reduce risk for this change...",
  "dashboardUrl": "https://www.re-entry.ai/dashboard"
}