Security Gate

Two small jobs: (1) run the threat-model-lite while the user is still choosing the feature, so later phases do not guess security decisions; (2) apply the deep-pass trigger list to each slice, then verify deep slices against those decisions. This skill never performs the review — full-review does.

The two leitwörter below are what you name as you work: a threat-model-lite question is something you ask the human now; a deep-pass trigger is a property of the change that forces a deeper review later.

Threat-model-lite — spec-time checklist (interactive)

Run this inside the requirements interview. Resolve repository facts from evidence and return only unresolved security decisions to the interview's frontier. These questions share its five-question limit; do not send a second question batch. Record the answers in the decision record. to-prd carries them into the PRD's Security Decisions section.

1. Actors & auth: who can invoke this? What roles/permissions gate each action? What happens for unauthenticated or wrong-role access?
2. Untrusted input: what data arrives from users or external systems? Where is it validated, and what is rejected?
3. Data sensitivity: does this touch PII, credentials, tokens, or financial data? Where is it stored, logged, or sent? What must never appear in logs or error messages?
4. Secrets: any new keys, tokens, or credentials? Where do they live (env, secret manager) and who rotates them?
5. Dependencies: any new packages or services? Why this one, and what is its blast radius if compromised?
6. Tenancy & access scope: can one user's request ever read or write another user's data? What enforces the boundary?
7. Abuse: what does a malicious or careless user do with this feature? Rate limits, quotas, idempotency?
8. Failure exposure: on error or timeout, what leaks (stack traces, internal IDs, partial writes)?