gsd-secure-phase

To verify threat mitigations after a development phase, inspect completed phase artifacts like SECURITY.md and PLAN.md files to confirm documented security controls were applied. This retroactive security audit validates whether the phase can be safely closed.

Retroactive security verification reviews finished phase artifacts to check whether promised mitigations were actually applied. It uses existing threat models and SECURITY.md files to validate security assumptions and confirm the phase is safe to close.

To audit a SECURITY.md file against a threat model, inspect the phase planning artifacts to validate security assumptions and outcomes. Confirm each documented mitigation is implemented, then generate an updated SECURITY.md recording mitigation status and outstanding risk.

Yes, you can use phase artifacts to check if documented security controls were applied. The verification process requires artifact inspection and mitigation confirmation against the phase plan to determine whether the phase can be validated safely.

The best way to record outstanding risk during phase closure is to generate an updated SECURITY.md file. This file documents the mitigation status from the threat model audit and captures any remaining security gaps for future action.

A PLAN.md threat model or existing SECURITY.md file is required for a phase security audit. The verification process depends on these artifacts to validate security assumptions, confirm mitigations, and determine whether the phase can be validated safely.