2 min lesson
Why block CI on security, not on every nit
Pick two rows from the table in "Why block CI on security, not on every nit" and explain the choice each one supports.
Step 1 of 2
Why block CI on security, not on every nitwhere the friction is worth it
Blocking the build is the strongest, most annoying control you have, so spend it where the cost of shipping the issue is highest. A security vuln in production can mean a breach; a missing test or a style nit can be fixed in the next PR. Gating on security and merely commenting on quality keeps the gate credible - engineers stop respecting a bot that blocks merges over trivia.
- Finding type
- Confirmed security vuln
- Action
- Block CI
- Why
- Cost of reaching production is a potential breach
- Finding type
- Likely vuln, unvalidated
- Action
- Slack escalation, no block
- Why
- Human confirms before paying the friction cost
- Finding type
- Code-quality nit
- Action
- Comment only
- Why
- Low cost to fix later; blocking erodes trust in the gate
| Finding type | Action | Why |
|---|---|---|
| Confirmed security vuln | Block CI | Cost of reaching production is a potential breach |
| Likely vuln, unvalidated | Slack escalation, no block | Human confirms before paying the friction cost |
| Code-quality nit | Comment only | Low cost to fix later; blocking erodes trust in the gate |
Interviewers want you to name the hard parts, not pitch the magic. False positives erode trust fast, so dedup and human-in-the-loop validation exist precisely to keep the signal worth a developer's attention. The review is only as good as how well its prompts encode the threat model, so prompt-tuning is ongoing security work, not a one-time setup. And an agent reviewing code is itself attackable - a PR could carry a prompt-injection payload aimed at the reviewer agent, which is its own threat to design against.
Tie it back to the builder-first culture. The point of agent-assisted review isn't to replace human reviewers - it's a paved road that engages the right humans on the important changes at the right time and shrinks the class of bugs that reach production. If asked how you'd improve it, reason out loud about measuring precision/recall on real findings, tuning prompts against actual past incidents and defending the reviewer agent itself from injection. Truth-seeking over a polished pitch is the value they're testing.