TechPrufer
Get started
Dropbox
Dropbox logoDropbox · Feature trail

Design-to-code security traceability

2 posts · Feb 2026 – Jun 2026

What this trail covers

Dropbox built a system using Model Context Protocol (MCP) and Dash to automatically retrieve relevant threat models during code review, bridging the gap between design decisions and code implementation. This system uses foundational LLMs to compare documented security requirements with proposed code changes, improving the visibility and enforcement of security policies. The initial analysis showed that only 12% of implementing PRs explicitly linked back to their threat models, with 69% of connections recoverable only through semantic search. The system aims to reduce manual cross-referencing and surface security findings invisible without the threat model.

All Dropbox trails
  1. How Dropbox uses MCP and Dash to close the design-to-code security gapThis post details the architecture of a system that uses Model Context Protocol (MCP) and Dash to automatically retrieve relevant threat models during code review. It leverages foundational LLMs to compare documented security requirements with proposed code changes, identifying gaps and improving traceability. The system was validated by analyzing security design reviews and their implementing code changes, revealing that only 12% of PRs explicitly linked to their threat models, with 69% of connections discoverable only through semantic search. The system aims to surface security findings that would otherwise be missed.
  2. Using LLMs to amplify human labeling and improve Dash search relevanceThis post describes the technical approach to using LLMs to generate relevance labels for Dash search results. It details the RAG pattern used by Dash, the importance of labeled relevance data for training ranking models, and the challenges of traditional human labeling. The core contribution is the hybrid approach of using a small set of human-labeled data to tune LLM prompts and parameters, followed by LLM-generated labels at scale. It also discusses the evaluation of LLM relevance judgments using Mean Squared Error (MSE) and the role of LLMs as teachers for smaller, efficient relevance models.