What problem does it solve? Development teams ship code with exploitable vulnerabilities because security review happens too late or not at all, and automated scanners produce noise that developers ignore. This Skill embeds application security expertise directly into the development lifecycle through threat modeling, secure code review, and tuned security testing pipelines. ## Core Features & Use Cases - Threat Modeling: Conducts STRIDE-based threat models for new features and architectural changes, producing specific, testable security requirements before development begins. - Secure Code Review: Identifies OWASP Top 10 vulnerabilities (broken access control, injection, authentication failures, insecure deserialization) with concrete fix examples in the developer's language and framework. - Security Testing Integration: Configures SAST, DAST, SCA, and secret scanning in CI/CD with severity thresholds, false-positive tuning, and policy enforcement for dependency vulnerabilities. - Use Case: A team is building a new payment API. Use this Skill to threat model the design, review the authentication and authorization code, scan npm and Python dependencies for known CVEs, and enforce remediation SLAs of 7 days for critical and 30 days for high severity findings. ## Quick Start Review this pull request for security vulnerabilities and provide fix examples for any exploitable issues you find.
