# How Dropbox Closes the Design-to-Code Security Gap Using MCP and Dash to bridge the security gap between design and code. - **Source:** [Dropbox Tech](https://dropbox.tech) - **Published:** 2026-06-12 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/ac6aa5d7-8acd-4321-9508-2e1f690c4f85 ## The Security Gap Problem In software development, security requirements defined during the design phase often get overlooked during code review. This disconnect leads to threat models being separated from the code. ## Dropbox's Approach Dropbox combined Model Context Protocol (MCP), large language models, and Dash to address this issue. This system automatically retrieves relevant threat models during code review and checks requirements. ## Importance of Threat Models Threat models outline potential risks and protections for a feature. However, these models often remain disconnected from the code and are ignored during review. ## The Gap Between Code and Design Dropbox's analysis shows that only 12% of code changes link back to their original design review. This gap makes it difficult to ensure security requirements are implemented. ## The Time Lag Issue There is often a gap of weeks or months between design review and code implementation. This delay leads to security requirements being forgotten or overlooked. ## Limitations of Existing Tools Static analysis tools can detect security controls in code but cannot verify if they align with design review requirements. This is due to a lack of context. ## Dash's Role Dash indexes and connects content stored in Dropbox. This makes years of security reviews and engineering documentation automatically accessible. ## MCP's Contribution Model Context Protocol (MCP) automatically retrieves threat models during code review and evaluates if code changes meet the defined requirements. ## Retroactive Reviews Dropbox's data shows that 15% of design reviews are filed retroactively. This indicates that some security requirements are identified after the code is implemented. ## Early Warning System Dash and MCP surface relevant security context during development. This provides an early signal for cases that may require additional review. ## Conclusion and Importance Dropbox's system closes the security gap between design and code, ensuring security requirements are implemented. This approach can serve as a model for other organizations. ## Sources covering this story - https://dropbox.tech/security/dropbox-mcp-dash-design-code-security — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._