security

PROACTIVELY use when reviewing dependencies, before releases, or during security audits. Checks dependencies for known CVEs, outdated packages, and supply chain risks. Analyzes package manifests and provides remediation guidance.

PROACTIVELY use before commits, during code reviews, or for security audits. Scans codebase for hardcoded secrets, API keys, credentials, tokens, and sensitive data patterns. Fast pattern-matching agent for detecting exposed secrets.

PROACTIVELY use for security-focused code review. Analyzes code for OWASP Top 10 vulnerabilities, CWE weaknesses, insecure patterns, authentication/authorization flaws, injection vulnerabilities, and security anti-patterns. Use when reviewing code changes, conducting security assessments, or before releases.

PROACTIVELY use when designing new features, reviewing architecture, or conducting security design reviews. Applies STRIDE methodology, identifies attack vectors, builds attack trees, and recommends security controls. Use for architectural threat analysis and security design documentation.

AI governance and compliance guidance covering EU AI Act risk classification, NIST AI RMF, responsible AI principles, AI ethics review, and regulatory compliance for AI systems.

Comprehensive API security guidance covering authentication methods, rate limiting, input validation, CORS, security headers, and protection against OWASP API Top 10 vulnerabilities. Use when designing API authentication, implementing rate limiting, configuring CORS, setting security headers, or reviewing API security.

Run security audit on code for OWASP Top 10, CWE vulnerabilities, and security anti-patterns

Comprehensive authentication implementation guidance including JWT best practices, OAuth 2.0/OIDC flows, Passkeys/FIDO2/WebAuthn, MFA patterns, and secure session management. Use when implementing login systems, token-based auth, SSO, passwordless authentication, or reviewing authentication security.

Comprehensive authorization guidance covering RBAC, ABAC, ACL, ReBAC, and policy-as-code patterns. Use when designing permission systems, implementing access control, or choosing authorization strategies.