security

[IMPORTANT] Use TaskCreate to break ALL work into small tasks BEFORE starting — including tasks for each file read. This prevents context loss from long files. For simple tasks, AI MUST ask user whether to skip.

Evidence-Based Reasoning — Speculation is FORBIDDEN. Every claim needs file:line proof. Confidence: >95% recommend freely, 80-94% with caveats, <80% DO NOT recommend — gather more evidence. Cross-service validation required for architectural changes. MUST READ .claude/skills/shared/evidence-based-reasoning-protocol.md for full protocol and checklists.

• docs/project-reference/domain-entities-reference.md — Domain entity catalog, relationships, cross-service sync (read when task involves business entities/models) (content auto-injected by hook — check for [Injected: ...] header before reading)

External Memory: For complex or lengthy work (research, analysis, scan, review), write intermediate findings and final results to a report file in plans/reports/ — prevents context loss and serves as deliverable.

Evidence Gate: MANDATORY IMPORTANT MUST — every claim, finding, and recommendation requires file:line proof or traced evidence with confidence percentage (>80% to act, <80% must verify first).

Quick Summary

Goal: Perform security review against OWASP Top 10 and project authorization patterns.

Workflow:

1. Scope — Identify security-sensitive code areas
2. Audit — Review against OWASP categories and platform security patterns
3. Report — Document findings with severity and remediation

Key Rules:

• Analysis Mindset: systematic review, not guesswork
• Check both backend and frontend attack surfaces
• Use project authorization attributes and entity-level access expressions (see docs/project-reference/backend-patterns-reference.md)

$ARGUMENTS

Analysis Mindset (NON-NEGOTIABLE)

Be skeptical. Apply critical thinking, sequential thinking. Every claim needs traced proof, confidence percentages (Idea should be more than 80%).

• Do NOT assume code is secure at face value — verify by reading actual implementations
• Every vulnerability finding must include file:line evidence
• If you cannot prove a vulnerability with a code trace, state "potential risk, not confirmed"
• Question assumptions: "Is this actually exploitable?" → trace the input path to confirm
• Challenge completeness: "Are there other attack vectors?" → check all input boundaries
• No "looks secure" without proof — state what you verified and how

Activate arch-security-review skill and follow its workflow.

CRITICAL: Present your security findings. Wait for explicit user approval before implementing fixes.

Graph-Assisted Investigation — When .code-graph/graph.db exists, MUST run at least ONE graph command on key files before concluding. Pattern: Grep finds files → trace --direction both reveals full system flow → Grep verifies details. Use connections for 1-hop, callers_of/tests_for for specific queries, batch-query for multiple files. MUST READ .claude/skills/shared/graph-assisted-investigation-protocol.md for full protocol and checklists. Run python .claude/scripts/code_graph query callers_of <function> --json to trace all entry points into sensitive functions.

Graph Intelligence (RECOMMENDED if graph.db exists)

If .code-graph/graph.db exists, enhance analysis with structural queries:

• Trace data flow to sensitive functions: python .claude/scripts/code_graph query callers_of <function> --json
• What does this function call? python .claude/scripts/code_graph query callees_of <function> --json
• Batch analysis: python .claude/scripts/code_graph batch-query file1 file2 --json

See .claude/skills/shared/graph-intelligence-queries.md for full query reference.

Graph-Trace for Data Flow Analysis

When graph DB is available, use trace to analyze data flow paths for security review:

• python .claude/scripts/code_graph trace <entry-point> --direction downstream --json — trace data flow from input to all consumers (find where untrusted data travels)
• python .claude/scripts/code_graph trace <sensitive-file> --direction upstream --json — find all entry points that reach sensitive code
• Trace reveals cross-service MESSAGE_BUS flows where data crosses trust boundaries

Workflow Recommendation

IMPORTANT MUST: If you are NOT already in a workflow, use AskUserQuestion to ask the user:

1. Activate quality-audit workflow (Recommended) — security → sre-review → test
2. Execute /security directly — run this skill standalone

Next Steps

MANDATORY IMPORTANT MUST after completing this skill, use AskUserQuestion to recommend:

• "/sre-review (Recommended)" — Production readiness review
• "/performance" — Analyze performance next
• "Skip, continue manually" — user decides

Closing Reminders

MANDATORY IMPORTANT MUST break work into small todo tasks using TaskCreate BEFORE starting. MANDATORY IMPORTANT MUST validate decisions with user via AskUserQuestion — never auto-decide. MANDATORY IMPORTANT MUST add a final review todo task to verify work quality. MANDATORY IMPORTANT MUST READ the following files before starting:

• MUST READ .claude/skills/shared/evidence-based-reasoning-protocol.md before starting
• MUST READ .claude/skills/shared/graph-assisted-investigation-protocol.md before starting