speckit-security-review-followup

Security review findings are transformed into trackable remediation tasks by categorizing items for immediate implementation, deferral as technical debt, or marking as covered. This generates Spec-Kit-ready TASK-SEC-NNN entries to prevent unresolved issues from being lost.

Backlog deduplication is achieved by cross-checking new security findings against existing unfinished tasks and memory-hub context. This prevents duplicate work by ensuring only net-new vulnerabilities generate Spec-Kit-ready remediation or technical-debt tasks.

Deferred CWE security findings are converted into technical-debt tasks with an explicit revisit trigger and rationale. This ensures lower-priority vulnerabilities are tracked systematically rather than ignored, maintaining a clear record for future remediation planning.

No, this workflow requires reading existing tasks and planning artifacts alongside review inputs. This context awareness is necessary to generate accurate Spec-Kit-ready entries and perform effective backlog deduplication against your current project state.

Durable memory is optionally captured using the /speckit.memory-md.capture command after generating remediation tasks. This preserves the context and rationale of security review follow-up plans for future reference across subsequent sprints.