Microsoft/bcquality
1
0
Fork 0
mirror of https://github.com/microsoft/BCQuality.git synced 2026-08-06 09:26:52 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Integrate current review domains

Browse source 
Merge current main because it added four active AL review leaves, then extend the findings domain contract across all 15 leaves, generic composition guidance, plugin documentation, and the self-review knowledge-upgrade path.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 77d0a40e-8bf5-40ac-a450-40eb0255db03
This commit is contained in:
Jesper Schulz-Wedde 2026-07-14 14:46:56 +02:00
commit 55aa40eb9e
269 changed files with 4806 additions and 827 deletions
Download patch file Download diff file Expand all files Collapse all files

15
microsoft/skills/review/al-security-review.md
View file

@ -89,7 +89,7 @@ Output conforms to the DO output contract. Every finding this skill emits MUST s
},
"findings": [
{
"id": "microsoft/knowledge/security/use-secrettext-for-credentials.md",
"id": "microsoft/knowledge/security/secrettext-for-credentials.md",
"severity": "blocker",
"message": "A bearer token is declared as a Text parameter and passed through the HTTP request path as plain text. The referenced guidance requires credentials to flow as SecretText end-to-end.",
"location": {
@ -98,21 +98,21 @@ Output conforms to the DO output contract. Every finding this skill emits MUST s
"range": { "start-line": 85, "end-line": 89 }
},
"references": [
{ "path": "microsoft/knowledge/security/use-secrettext-for-credentials.md" }
{ "path": "microsoft/knowledge/security/secrettext-for-credentials.md" }
],
"confidence": "high",
"domain": "Security"
},
{
"id": "microsoft/knowledge/security/never-hardcode-secrets-in-al.md",
"id": "microsoft/knowledge/security/secrets-isolated-storage.md",
"severity": "minor",
"message": "An API key is assigned from a string literal rather than retrieved from IsolatedStorage or Key Vault at runtime.",
"message": "A setup table stores an API key in an ordinary Text field, exposing it through table reads and exports. Persist it in IsolatedStorage instead.",
"location": {
"file": "src/Integration/ApiClient.Codeunit.al",
"line": 201
"file": "src/Integration/ExternalServiceSetup.Table.al",
"line": 12
},
"references": [
{ "path": "microsoft/knowledge/security/never-hardcode-secrets-in-al.md" }
{ "path": "microsoft/knowledge/security/secrets-isolated-storage.md" }
],
"confidence": "medium",
"domain": "Security"
@ -136,4 +136,3 @@ The empty-corpus case — BCQuality's state until security knowledge files land
"suppressed": []
}
```