speckit-security-review-init

To establish a source of truth for security audits, you initialize a Security Constitution document defining trust boundaries, authentication standards, and enforceable rules. This creates an authoritative reference for compliance mapping and security reviews.

A Security Constitution is a structured document capturing your project's trust boundaries, identity model, data privacy rules, and secrets policies. You need one to establish baseline standards for consistent security auditing and compliance mapping.

You document trust boundaries and secrets management policies by running a Security Discovery Interview. This process gathers access models, data sensitivity needs, and infrastructure requirements to generate an audit-ready constitution file.

Yes, you can refine an existing security constitution file without losing current rules. The initialization process detects existing security files and applies non-destructive guardrails during overwrites to preserve your original configurations.

The limitation of using a security constitution for compliance mapping is its reliance on accurate discovery inputs. If your security discovery interview lacks precise data privacy or authentication details, the generated constitution will contain incomplete audit guardrails.