security

PROACTIVELY use when reviewing dependencies, before releases, or during security audits. Checks dependencies for known CVEs, outdated packages, and supply chain risks. Analyzes package manifests and provides remediation guidance.

PROACTIVELY use before commits, during code reviews, or for security audits. Scans codebase for hardcoded secrets, API keys, credentials, tokens, and sensitive data patterns. Fast pattern-matching agent for detecting exposed secrets.

PROACTIVELY use for security-focused code review. Analyzes code for OWASP Top 10 vulnerabilities, CWE weaknesses, insecure patterns, authentication/authorization flaws, injection vulnerabilities, and security anti-patterns. Use when reviewing code changes, conducting security assessments, or before releases.

PROACTIVELY use when designing new features, reviewing architecture, or conducting security design reviews. Applies STRIDE methodology, identifies attack vectors, builds attack trees, and recommends security controls. Use for architectural threat analysis and security design documentation.

AI governance and compliance guidance covering EU AI Act risk classification, NIST AI RMF, responsible AI principles, AI ethics review, and regulatory compliance for AI systems.

Comprehensive API security guidance covering authentication methods, rate limiting, input validation, CORS, security headers, and protection against OWASP API Top 10 vulnerabilities. Use when designing API authentication, implementing rate limiting, configuring CORS, setting security headers, or reviewing API security.

Run security audit on code for OWASP Top 10, CWE vulnerabilities, and security anti-patterns

Comprehensive authentication implementation guidance including JWT best practices, OAuth 2.0/OIDC flows, Passkeys/FIDO2/WebAuthn, MFA patterns, and secure session management. Use when implementing login systems, token-based auth, SSO, passwordless authentication, or reviewing authentication security.

Comprehensive authorization guidance covering RBAC, ABAC, ACL, ReBAC, and policy-as-code patterns. Use when designing permission systems, implementing access control, or choosing authorization strategies.

Check dependencies for known CVEs and security vulnerabilities

Container and Kubernetes security patterns including Docker hardening, image scanning, pod security standards, network policies, RBAC, secrets management, and runtime protection. Use when securing containerized applications, building secure images, or configuring Kubernetes security controls.

Comprehensive cryptography guidance covering encryption algorithms, password hashing, TLS configuration, key management, and post-quantum considerations. Use when implementing encryption, choosing hashing algorithms, configuring TLS/SSL, managing cryptographic keys, or reviewing cryptographic implementations.

DevSecOps methodology guidance covering shift-left security, SAST/DAST/IAST integration, security gates in CI/CD pipelines, vulnerability management workflows, and security champions programs.

Comprehensive security review combining code audit, secrets scan, and dependency check

Scan codebase for hardcoded secrets, API keys, credentials, and sensitive data

Comprehensive guidance for secure secrets management including storage solutions (Vault, AWS Secrets Manager, Azure Key Vault), environment variables, secret rotation, scanning tools, and CI/CD pipeline security. Use when implementing secrets storage, configuring secret rotation, preventing secret leaks, or reviewing credentials handling.

Provides guidance on secure coding practices including OWASP Top 10 2025, CWE Top 25, input validation, output encoding, and language-specific security patterns. Use when reviewing code for security vulnerabilities, implementing security controls, or learning secure development practices.

Software supply chain security guidance covering SBOM generation, SLSA framework, dependency scanning, SCA tools, and protection against supply chain attacks like dependency confusion and typosquatting.

Threat modeling methodologies (STRIDE, DREAD), attack trees, threat modeling as code, and integration with SDLC for proactive security design

Vulnerability lifecycle management including CVE tracking, CVSS scoring, risk prioritization, remediation workflows, and coordinated disclosure practices

Zero Trust architecture principles including ZTNA, micro-segmentation, identity-first security, continuous verification, and BeyondCorp patterns. Use when designing network security, implementing identity-based access, or building cloud-native applications with zero trust principles.