security-lens-reviewer

Plan-level security review evaluates planning documents to inventory attack surfaces, flag missing auth/authz decisions, identify sensitive data exposure risks, and outline top exploitable threats. It generates a prioritized list of security gaps and mitigations for early-stage design.

A threat model and attack surface assessment is needed during early-stage planning and architecture reviews before implementation begins. It inventories new endpoints, data stores, and integrations to surface missing security considerations and ensure explicit access control decisions.

Reviewing data protection considerations in product plans involves evaluating how sensitive data is handled in transit, at rest, in logs, and regarding retention. This plan-level review flags sensitive data exposure needs and outputs prioritized mitigation suggestions.

Yes, plan-level security review applies to early-stage planning and risk discussions without existing code. It evaluates plan-level artifacts containing architectural decisions, inventories the attack surface, and outputs prioritized security findings and mitigations before implementation.

Plan-level security review requires plan-level artifacts with explicit authentication and authorization decisions to function effectively. Without these explicit access control decisions, the review cannot accurately identify auth/authz gaps or generate prioritized findings.