TechPrufer
Sign inGet started

Blogs›Dropbox›Design-to-code security traceability

Design-to-code security traceability

Design-to-code security traceability

2
posts
2026

Dropbox built a system using Model Context Protocol (MCP) and Dash to automatically retrieve relevant threat models during code review, bridging the gap between design decisions and code implementation. This system uses foundational LLMs to compare documented security requirements with proposed code changes, improving the visibility and enforcement of security policies. The initial analysis showed that only 12% of implementing PRs explicitly linked back to their threat models, with 69% of connec. This post details how LLMs are used to amplify human labeling efforts to improve the relevance of Dash search results. By combining human-labeled data with LLM-generated labels, Dropbox is able to train more effective relevance models at scale, leading to better search outcomes within Dash.

2026

How Dropbox uses MCP and Dash to close the design-to-code security gap

6/12/2026

Introduced a system leveraging Model Context Protocol (MCP) and Dash to automatically retrieve and analyze threat models during code review. This system uses foundational LLMs to compare code changes against documented security requirements, aiming to close the design-to-code security gap. The post details the architecture, the problem of the design-to-code gap (highlighting that only 12% of PRs link to threat models and a median delay of five weeks between review and implementation), and the validation of the approach through semantic search analysis.

Using LLMs to amplify human labeling and improve Dash search relevance

2/26/2026

This post describes the technical approach to using LLMs to generate relevance labels for Dash search results. It details the RAG pattern used by Dash, the importance of labeled relevance data for training ranking models, and the challenges of traditional human labeling. The core contribution is the hybrid approach of using a small set of human-labeled data to tune LLM prompts and parameters, followed by LLM-generated labels at scale. It also discusses the evaluation of LLM relevance judgments using Mean Squared Error (MSE) and the role of LLMs as teachers for smaller, efficient relevance models.