How Dropbox Closes the Design-to-Code Security Gap
Using MCP and Dash to bridge the security gap between design and code.
1The Security Gap Problem
In software development, security requirements defined during the design phase often get overlooked during code review. This disconnect leads to threat models being separated from the code.
2Dropbox's Approach
Dropbox combined Model Context Protocol (MCP), large language models, and Dash to address this issue. This system automatically retrieves relevant threat models during code review and checks requirements.
3Importance of Threat Models
Threat models outline potential risks and protections for a feature. However, these models often remain disconnected from the code and are ignored during review.
4The Gap Between Code and Design
Dropbox's analysis shows that only 12% of code changes link back to their original design review. This gap makes it difficult to ensure security requirements are implemented.
5The Time Lag Issue
There is often a gap of weeks or months between design review and code implementation. This delay leads to security requirements being forgotten or overlooked.
6Limitations of Existing Tools
Static analysis tools can detect security controls in code but cannot verify if they align with design review requirements. This is due to a lack of context.
7Dash's Role
Dash indexes and connects content stored in Dropbox. This makes years of security reviews and engineering documentation automatically accessible.
8MCP's Contribution
Model Context Protocol (MCP) automatically retrieves threat models during code review and evaluates if code changes meet the defined requirements.
9Retroactive Reviews
Dropbox's data shows that 15% of design reviews are filed retroactively. This indicates that some security requirements are identified after the code is implemented.
10Early Warning System
Dash and MCP surface relevant security context during development. This provides an early signal for cases that may require additional review.
11Conclusion and Importance
Dropbox's system closes the security gap between design and code, ensuring security requirements are implemented. This approach can serve as a model for other organizations.
Original article: Dropbox Tech — Dropbox'un Tasarımdan Koda Güvenlik Açığını Kapatma Yöntemi