What problem does it solve? Teams running Scrum often treat security as an afterthought, leading to vulnerabilities shipped to production, hidden incidents due to blame culture, and security debt that never gets prioritized. This Skill embeds security directly into sprint planning, Definition of Done, retrospectives, and team health practices. ## Core Features & Use Cases - Security Definition of Done: Enforces SAST, SCA, secrets, and IaC scanning gates (Semgrep, CodeQL, Snyk, Gitleaks, Checkov) so no increment ships with Critical/High findings. - Threat Modeling in Sprints: Provides STRIDE quick-scans per user story, misuse story templates, and guidance on when to use PASTA or MITRE ATT&CK. - Security Champions & Culture: Defines the Security Champions model, blameless postmortem templates, psychological safety practices, and retrospective formats. - Metrics & Governance: Covers DORA metrics benchmarks, OWASP SAMM maturity integration, security debt SLAs, and AI-assisted code governance rules. - Use Case: A Scrum Master planning a sprint for a fintech team uses this Skill to run STRIDE quick-scans on new payment stories, write misuse stories for IDOR risks, allocate 15% capacity to security debt, and enforce the security DoD checklist in CI. ## Quick Start Help me plan a security-first sprint for my team, including threat modeling for our new API stories and a security Definition of Done checklist.
