4. Security & Compliance

Enforces security and compliance by requiring evidence for all development steps and defaulting to safe, closed states during uncertainty.

Provides iOS/tvOS security best practices including Keychain, certificate pinning, secure storage, and API key protection.

Performs dependency vulnerability scanning using npm audit and Trivy to identify security risks in project dependencies.

Designs layered security architecture with multiple independent barriers to eliminate single points of failure in security systems.

Provides advanced security hardening techniques including zero-trust architecture, secret management, and compliance framework implementation.

Applies OWASP security best practices to prevent vulnerabilities, secure authentication, and configure security headers in web applications.

Provides input/output guards, toxicity detection, PII protection, and injection defense to secure AI applications and ensure compliance.

Provides security testing patterns covering OWASP Top 10 vulnerabilities, injection prevention, authentication, and vulnerability scanning.

Securely retrieves website credentials from 1Password using URL-based lookup, eliminating manual password handling and ensuring compliance.

Validates DAPR HTTP middleware configuration for security best practices, correct types, secret references, and pipeline ordering.

Scans DAPR projects for security issues including plain-text secrets, missing ACLs, and insecure configurations. Automatically triggers on component file changes.

Expert web security auditor specializing in XSS prevention, CSRF protection, CSP implementation, and dependency vulnerability scanning.

Executes security reviews including code audits and vulnerability assessments as a subagent, activated by explicit request or other skill requirements.

Mandatory OWASP-based security review for authentication, input handling, API, and database code changes, required before pull requests.

Conducts security reviews for blockchain and cryptographic code, including vulnerability checks during PR audits and security assessments.

Secures game servers through encryption, anti-cheat mechanisms, and secure communication protocols.

Provides production-grade security testing, vulnerability scanning, and penetration testing guidance aligned with OWASP Top 10 and compliance standards.

Provides DevSecOps security practices for secrets management, SSL/TLS, vulnerability scanning, and compliance.

Analyzes web content for SEO and accessibility compliance, ensuring WCAG 2.1 AA, color contrast, heading structure, and meta tags.

Senior security engineer for implementing auth, OAuth2/JWT, security reviews, rate limiting, GDPR compliance, and security scanning.

Provides security reviews, vulnerability scanning, and secure coding guidance for code and systems upon request.

Generates STRIDE-based threat models for repositories to support security monitoring setup, post-architecture changes, and security audits.

Scans code changes for security vulnerabilities using AI reasoning and threat models, ideal for PR reviews and pre-commit checks.

Scans code changes for security vulnerabilities using STRIDE threat modeling, validates exploitability, and outputs structured results for patch generation in PR reviews and audits.