security

[IMPORTANT] Use TaskCreate to break ALL work into small tasks BEFORE starting — including tasks for each file read. This prevents context loss from long files. For simple tasks, AI MUST ask user whether to skip.

Prerequisites: MUST READ .claude/skills/shared/evidence-based-reasoning-protocol.md before executing.

• docs/project-reference/domain-entities-reference.md — Domain entity catalog, relationships, cross-service sync (read when task involves business entities/models)

External Memory: For complex or lengthy work (research, analysis, scan, review), write intermediate findings and final results to a report file in plans/reports/ — prevents context loss and serves as deliverable.

Evidence Gate: MANDATORY IMPORTANT MUST — every claim, finding, and recommendation requires file:line proof or traced evidence with confidence percentage (>80% to act, <80% must verify first).

Quick Summary

Goal: Perform security review against OWASP Top 10 and project authorization patterns.

Workflow:

1. Scope — Identify security-sensitive code areas
2. Audit — Review against OWASP categories and platform security patterns
3. Report — Document findings with severity and remediation

Key Rules:

• Analysis Mindset: systematic review, not guesswork
• Check both backend and frontend attack surfaces
• Use project authorization attributes and entity-level access expressions (see docs/project-reference/backend-patterns-reference.md)

$ARGUMENTS

Analysis Mindset (NON-NEGOTIABLE)

Be skeptical. Apply critical thinking, sequential thinking. Every claim needs traced proof, confidence percentages (Idea should be more than 80%).

• Do NOT assume code is secure at face value — verify by reading actual implementations
• Every vulnerability finding must include file:line evidence
• If you cannot prove a vulnerability with a code trace, state "potential risk, not confirmed"
• Question assumptions: "Is this actually exploitable?" → trace the input path to confirm
• Challenge completeness: "Are there other attack vectors?" → check all input boundaries
• No "looks secure" without proof — state what you verified and how

Activate arch-security-review skill and follow its workflow.

CRITICAL: Present your security findings. Wait for explicit user approval before implementing fixes.

Graph Intelligence (MANDATORY when graph.db exists): MUST READ .claude/skills/shared/graph-assisted-investigation-protocol.md. Run python .claude/scripts/code_graph query callers_of <function> --json to trace all entry points into sensitive functions.

Graph Intelligence (RECOMMENDED if graph.db exists)

If .code-graph/graph.db exists, enhance analysis with structural queries:

• Trace data flow to sensitive functions: python .claude/scripts/code_graph query callers_of <function> --json
• What does this function call? python .claude/scripts/code_graph query callees_of <function> --json
• Batch analysis: python .claude/scripts/code_graph batch-query file1 file2 --json

See .claude/skills/shared/graph-intelligence-queries.md for full query reference.

Graph-Trace for Data Flow Analysis

When graph DB is available, use trace to analyze data flow paths for security review:

• python .claude/scripts/code_graph trace <entry-point> --direction downstream --json — trace data flow from input to all consumers (find where untrusted data travels)
• python .claude/scripts/code_graph trace <sensitive-file> --direction upstream --json — find all entry points that reach sensitive code
• Trace reveals cross-service MESSAGE_BUS flows where data crosses trust boundaries

---

IMPORTANT Task Planning Notes (MUST FOLLOW)

• Always plan and break work into many small todo tasks
• Always add a final review todo task to verify work quality and identify fixes/enhancements

---

Workflow Recommendation

IMPORTANT MUST: If you are NOT already in a workflow, use AskUserQuestion to ask the user:

1. Activate quality-audit workflow (Recommended) — security → sre-review → test
2. Execute /security directly — run this skill standalone

---

Next Steps

MANDATORY IMPORTANT MUST after completing this skill, use AskUserQuestion to recommend:

• "/sre-review (Recommended)" — Production readiness review
• "/performance" — Analyze performance next
• "Skip, continue manually" — user decides

Closing Reminders

MANDATORY IMPORTANT MUST break work into small todo tasks using TaskCreate BEFORE starting. MANDATORY IMPORTANT MUST validate decisions with user via AskUserQuestion — never auto-decide. MANDATORY IMPORTANT MUST add a final review todo task to verify work quality.