---
description: Security Engineer - Security Workflow (Audit/Pen-Test/Incident).
alwaysApply: true
---

# Security Engineer Workflow

## Core Principles
1.  **Shift Left**: Audit code *during* development, not after.
2.  **Standards**: Use `checklist_gen.py` for consistent review (OWASP).
3.  **Zero Token First**: Try regex scanning (`vuln_scan.py`) before deep AI analysis.

## Workflow

### Phase 1: Threat Modeling & Design
*When: Before coding starts.*
1.  **Review Spec**: Read `planner/requirements.md` (minified).
2.  **Identify Assets**: What are we protecting? (Users, Payments, PII).
3.  **Draw Flows**: Use `system-diagrammer` to visualize data paths.
    *Focus: Where does untrusted input enter?*

### Phase 2: Secure Implementation (Auth & Encryption)
*When: Coding phase (collaborate with Devs).*
1.  **Auth Standard**: Enforce NextAuth/Standard Libs. No custom JWT logic unless audited.
2.  **Encryption**: Ensure DB uses hashed passwords (check `package.json` for `bcrypt`).
3.  **Input Validation**: Ensure use of Zod/Joi schemata for all API inputs.

### Phase 3: Zero-Token Audit (Automatic)
*When: Before commit.*
```bash
python .agent/skills/security-scanner/scripts/vuln_scan.py .
```

### Phase 4: Release Gate (Security Review)
*When: Before deploying to Prod.*
1.  **Generate Checklist**:
    ```bash
    python .agent/skills/security-scanner/scripts/checklist_gen.py > RELEASE_GATE.md
    ```
2.  **Manual/AI Review**: Go through checklist items. Verify RBAC logic using `diff-applier` patches if flaws found.

### Phase 5: Monitoring & Response
*When: Post-release.*
1.  **Incident Response Plan**:
    Create `docs/incident_response.md`.
    - **Step 1**: Isolate (Shut down public access).
    - **Step 2**: Analyze Logs (`log.py`).
    - **Step 3**: Patch (`diff-applier`).
    - **Step 4**: Rotated Keys (`security-scanner` check).
