[codex] Guardrail backlog: Security or authorization gap (security-authz)

[haasonsaas]

Security or authorization gap

This issue tracks a recurring review-feedback class from the EvalOps review feedback sentinel.

• Class: security-authz
• Score: 160
• Findings: 2
• Repos: evalops/platform
• Generated at: 2026-05-14T18:59:34Z
• Window: merged since 2026-05-11 with minimum severity high

Guardrail to build

Add an auth/security regression test or static rule covering the vulnerable boundary.

Representative feedback

• p1 evalops/platform#1997 internal/vfs/http/auth.go:27
  • Restrict workspace override to the workspace claim
  • https://github.com/evalops/platform/pull/1997#discussion_r3241088850
• p1 evalops/platform#1995 pkg/resilience/breaker.go:192
  • Treat filtered errors as neutral, not successful
  • https://github.com/evalops/platform/pull/1995#discussion_r3240591062

Finding fingerprints

• a035c9a29b9ac416a6cb8f4178b9f6d6135193727e24f703010b6d7c7acf1454
• f1bbaef1a1203eab4e38fa88bb57313501046dc421895828a051db450b74537b

Acceptance criteria

• The class has an owner repo and a concrete guardrail location.
• The guardrail fails for at least one representative feedback shape listed above.
• The guardrail is wired into the smallest relevant CI or preflight target.
• The issue is closed only after the guardrail has merged and the feedback sentinel no longer ranks this class as an unaddressed candidate.

[haasonsaas]

Closing because the review feedback sentinel no longer ranks security-authz as an active guardrail candidate in the current backlog window.