How Dropbox Closes the Design-to-Code Security Gap Using MCP and Dash

Even when the security team defines protective measures through a Threat Model at the design stage, a problem arises where those requirements are not made visible at the actual development stage, during Code Review. According to Dropbox's investigation, only 12% of implemented PRs (Pull Requests) were linked to a design review.

The time gap between design and implementation was also a problem. The median time from a security review to PR creation was about 5 weeks, and 54% of cases experienced delays of more than a month. Existing static analysis tools have the limitation of only checking code patterns, without being able to determine whether the intent or context from the design stage was properly reflected.

To reduce this gap, Dropbox built a system that combines three technologies.

• MCP (Model Context Protocol)
• Foundational LLM
• Dash (Dropbox's AI feature)

This system leverages the vast amount of security review and engineering documentation within Dropbox indexed by Dash to automatically retrieve relevant threat models during code review and assess whether code changes align with design requirements.