security

Automate threat modeling and OWASP security checks by enforcing STRIDE-aligned architecture assessments and baseline artifact validation to generate a risk-ranked remediation backlog. This requires planning artifacts like threat-model.md and owasp-top-10-results.md.

Perform a security review before a merge by running Phase B and Phase C checks across architecture, integrations, and deployment configurations. This produces concrete, risk-ranked remediation tasks to address vulnerabilities.

Dependency risk vetting and secret scanning are supported through integrated tools like pip-audit and gitleaks. It also reviews secret management practices to ensure sensitive credentials are not exposed in the codebase.

You can use this threat modeling process for both Phase B architecture design and Phase C implementation reviews. It assesses authentication, data protection, and security misconfigurations like CORS and TLS across both phases.

Docker is required to run the baseline security audit scripts and execute dependency checks. The workflow also relies on package managers like pnpm, yarn, npm, and dotnet to validate environment configurations.

Specific markdown planning artifacts like data-protection.md and authorization-review.md are required to formalize the security review process. They provide the necessary context to drive concrete remediation steps instead of generic checks.