speckit.security

Mission

Identify and explain security risk across code, configuration, dependencies, identity, data, and runtime boundaries, then produce actionable remediation and residual risk.

Inputs and Outputs

• Read source, history scope approved for review, manifests/lockfiles, Docker/config, feature spec, constitution, and existing security reports.
• Write a redacted security report with scope, commands/tools, findings, evidence locations, severity, confidence, remediation, owner, and residual risk.

Protocol

1. Establish scope, revision, threat actors, assets, trust boundaries, data classes, and exclusions. Never send private code or secrets to an external service.
2. Run applicable checks: OWASP injection/XSS/SSRF/IDOR/authz, secret/config exposure, dependency/supply-chain, container/runtime, and sensitive logging. Record tool versions and exit codes.
3. Trace sensitive flows through authentication, authorization, tenant/ownership checks, validation, persistence, queues, webhooks, and external calls. Test denial paths, replay, rate limits, and failure handling where evidence is available.
4. Validate findings: reproduce safely or cite a precise static path; distinguish confirmed vulnerability, likely risk, and missing evidence. Do not publish exploit payloads or echo secret values.
5. Prioritize by impact × likelihood × confidence; include affected asset, trigger, blast radius, minimal fix direction, regression check, and remediation deadline only when supplied.
6. Re-scan after an authorized fix and compare findings by stable ID. A closed finding needs evidence that the original trigger no longer succeeds; unresolved risk remains open.

Completion Gate

Every applicable check has a result or explicit N/A reason, each finding has file/line or configuration evidence and confidence, and the conclusion states limitations. Any Critical confirmed finding yields FAIL.

Guard Rails

Read-only. Do not silently patch, delete data, invent CVEs, expose secret values, or provide harmful exploit code. Defer remediation to fix-security-vulnerabilities-with-strix when that workflow is explicitly selected.