speckit-security-review-apply

Applying security review findings to spec-kit planning artifacts converts approved follow-up items into implementable backlog work. It updates your local planning documents to reflect security decisions while preserving existing task sequencing and implementation boundaries.

Yes, you can preview security review backlog updates before modifying tasks.md by requesting a dry-run. This produces proposed changes to your planning artifacts without actually editing the files, allowing you to review the security-driven task additions safely.

Applying security follow-ups to plan.md preserves existing task numbering and formatting. It avoids duplicating already-covered tasks and maintains implementation boundaries while ensuring high-severity security items are correctly prioritized within the backlog.

You need to update plan.md for security follow-ups only when security sequencing or decisioning truly requires it. Otherwise, the process applies approved items by primarily updating tasks.md to reflect the security-driven backlog changes without unnecessary refactors.

Managing vulnerability findings in a spec-kit memory hub involves reading and reconciling follow-up inputs with memory hub context. The process conditionally captures durable memory when patterns emerge, ensuring security-driven updates are tracked across planning artifacts.

Applying vulnerability management updates without a full backlog refactor involves targeting security-driven changes across tasks.md and plan.md. This adds new or missing security items while preserving existing task numbering, formatting, and implementation boundaries.