plan-security

A three-layer security scan identifies vulnerabilities through static rule checks, contextual analysis against design documents, and adversarial thinking to assess OWASP Top 10 risks and sensitive data handling in your codebase.

Adversarial thinking in security scanning simulates attack scenarios to validate protection strength, acting as a third scan layer that mimics malicious behavior against your codebase outputs to identify exploitable vulnerabilities.

To generate a security report for plan-build outputs, execute the security scan command. It analyzes the outputs and writes a detailed vulnerability assessment directly to your .spec/{slug}/security.md file.

Yes, you need .spec files and project CLAUDE.md security guidance to run a contextual security scan. The contextual analysis layer reads these design documents and project frameworks to perform deep vulnerability assessments.

While static analysis alone provides fast automated detection of known patterns, combining it with contextual checks for API security yields deeper results by evaluating design documents and project frameworks against identified risks.

The limitation of relying solely on static rule checks for vulnerability detection is missing complex logical flaws. Static checks only catch known patterns, whereas contextual analysis and adversarial thinking are required to uncover deeper design and behavioral risks.