Review Output & Findings

What a completed design review contains.

A completed design review surfaces two categories of findings:

Field	Description
Potential Security Issues	Potential issues, threats, and abuse cases identified based on the proposed design.
Security Requirements	Properties the implementation must satisfy, derived from your threat model.

High-criticality items are security requirements; lower-criticality items are recommendations.

Supporting detail

Depending on the design being reviewed, DevArmor also tracks:

• Abuse cases — specific ways the feature's use cases could be exploited, each tied to a use case and the access level required to carry it out.

• Use cases — the intended interactions between an actor and the feature.

• Assets — the things of value the design touches, that a threat actor might target.

• Pen tests — suggested penetration test scopes, each targeting a specific component, that can be pushed to a bug bounty program or pentest consultant.

• Policies and rules — the security policies applicable to the design, and, if configured, the AI Guardrails rules that enforce them in code.

Turning findings into work

Findings become tasks the same way threat model output does — see Implement Threat Model Results. Tasks created from a design review can be pushed to Jira or linked to an existing Jira issue, and stay in sync automatically when the linked issue's title, priority, status, or labels change.