[shrsv]

Adds a convenience API client pre-configured for the local dev environment.

Simulated for this demo: org has a blocking ruleset no-secrets (jq: [.findings[] | select(.type == "hardcoded-secret")] | length > 0).

[livereviewbot]

LiveReview automated review

Scanned 1 changed file (+12/-0).

🔴 Critical — Security — hardcoded-secret (internal/apiclient.go:5): DefaultAPIKey is a hardcoded credential committed directly to source, and NewDefaultAPIClient ships it as the default for every caller -- "local testing only" notwithstanding, this is now live in git history and in every build of the binary.

[livereviewbot]

Auto-approve policy evaluation

Stage	Result
Eligibility	✅ pass
LLM classification	✅ pass
Risk score vs. threshold	(would also fail, but the static gate short-circuits first)
Static ruleset gate -- no-secrets: [.findings[] | select(.type == "hardcoded-secret")] | length > 0 → matches	❌ tripped

Verdict: BLOCKED at the static gate. Rulesets are deliberately blunt and absolute by design -- unlike the scored risk stages, a tripped blocking ruleset isn't weighed against anything else about the diff. This org decided hardcoded-secret findings are a hard no, full stop, and configured a rule to say so in a single jq expression evaluated directly against the findings JSON.

[livereviewbot]

Auto-approve policy verdict: BLOCKED (static gate). The no-secrets blocking ruleset tripped on a hardcoded-secret finding.