Security
Threat modelling, secure review, hardening and supply-chain safety.
Download all 15
- Respond to a leaked secret
Produces an ordered response plan for an exposed key, token or password - revoke and rotate, audit use, clean up copies, notify and prevent. Use right after a secret is committed, logged or shared.
- Review an API against the OWASP API Top 10
Reviews an API design or implementation against the OWASP API Security Top 10, from object-level authorization and mass assignment to rate limits and SSRF, with attack paths and fixes.
- Review a cloud IAM policy
Reviews AWS, GCP or Azure IAM policies for over-broad permissions, privilege-escalation paths, wildcard resources and missing conditions, and proposes least-privilege versions.
- Review a pull request for security
Reviews a diff for exploitable vulnerabilities and reports only findings with a concrete attack path. Use before merging changes to input handling, auth, data access or dependencies.
- Threat model a feature
Builds a threat model for one feature or change, mapping data flows and trust boundaries to ranked threats and mitigations. Use during design, before the code is written or merged.
- Triage a vulnerability report
Triages an external vulnerability or bug bounty report by checking the claim, rating severity with CVSS, deciding valid, duplicate or out of scope, and drafting the reply. Use for security inboxes.
- Vet a dependency before adding it
Checks a third-party package for supply-chain risk, maintenance health, license fit and real need before it is added or upgraded. Use when a PR adds a new dependency or bumps one.
- Triage dependency vulnerabilities
Triages dependency scan findings by reachability and exploitability, gives the upgrade path, and justifies anything safe to defer. Use when a scanner reports more than the team can fix at once.
- Harden web app headers and cookies
Produces hardened HTTP security headers, a Content Security Policy, CORS and cookie settings for a web app, rolled out first in report-only mode. Use before launch or after a security scan.
- Plan secrets management
Plans secrets management for a stack, covering inventory, storage, runtime injection, rotation, access control and leak detection. Use when secrets live in env files, CI variables and chat.
- Review an authentication flow
Reviews an authentication or session design (OAuth or OIDC, tokens, cookies, MFA, password reset) for known flaws, with attack paths and fixes. Use before building or shipping login and session code.
- Review an LLM app for security
Reviews an LLM app for prompt injection, data exfiltration through tools, excessive agency and unsafe output handling, mapped to the OWASP LLM Top 10. Use before shipping an agent or RAG feature.
- Secure coding rules
Makes the assistant write code that validates untrusted input, avoids injection, protects secrets and checks authorization by default. Use as always-on rules in any codebase.
- Security auditor
Reviews code for exploitable weaknesses and reports only issues with a concrete attack path. Use as a reviewer persona or subagent for security-sensitive changes.
- Write a security policy and disclosure process
Writes a SECURITY.md and the disclosure process behind it, with supported versions, how to report, response times and safe harbour. Use when a project has no clear way to report vulnerabilities.
Wins every tie inside software-engineering. Not: legal compliance drafting (compliance).