---
model: opus
---

# /tas-security $ARGUMENTS

Check codebase security, save report to docs/security-report.md.

## Stack Detection
Read `.tas/rules/common/stack-detection.md`.

## Actions

### Step 1 — Determine scope
`$ARGUMENTS` can be:
- File path or directory → scan specified scope only
- Empty → scan entire codebase
- `--staged` → only scan staged files (like pre-commit hook), fast + used to self-test before commit

With `--staged`: get list from `git diff --cached --name-only --diff-filter=ACM` and only review those files. Use same regex patterns as `.tas/hooks/security-scan.js` then supplement with deep review by agents below.

Read `.tas/rules/common/security.md` for general checks. If stack identified, also read `.tas/rules/[stack]/security.md` for stack-specific items.

### Step 2 — Parallel Security Scan

Launch agents SIMULTANEOUSLY based on stack:

**Agent 1 — `security-reviewer`** (always run):
> Security audit [scope].
> Read `.tas/rules/common/security.md`.
> If stack identified, also read `.tas/rules/[stack]/security.md`.
> Check OWASP Top 10: injection, broken auth, XSS, IDOR, security misconfiguration,
> sensitive data exposure, insecure deserialization, vulnerable components, logging/monitoring.
> Also check: hardcoded secrets, CORS config, anti-forgery tokens, rate limiting.
> Format: findings by Critical / High / Medium / Low with file:line and specific remediation.
> Each finding has: status = Open.

**Agent 2 — `database-reviewer`** (only when `db_agent = database-reviewer`):
> Database security review [scope].
> Focus: parameterized queries vs string concatenation, ORM raw query usage,
> sensitive data stored in plaintext, missing field-level encryption, excessive permissions.
> Format: findings by Critical / High / Medium / Low with file:line and remediation.

**Agent 3 — `aws-reviewer`** (only when `infra_agent = aws-reviewer`):
> AWS infrastructure security review [scope].
> Focus: IAM overpermission, S3 public access, secrets in env/config/code,
> Lambda environment variables, API Gateway auth, VPC security groups.
> Format: findings by Critical / High / Medium / Low with file:line and remediation.

Wait for ALL agents to complete.

### Step 3 — Synthesize and save report

Combine findings from all agents, deduplicate (same file:line → merge), sort by severity.

Check `docs/security-report.md`:
- **Doesn't exist**: create new per template `.tas/templates/Security-Report.md`
- **Exists**: append new report, update old findings status if fixed

Report content includes:
- Scan date, scope, stack
- Findings by Critical / High / Medium / Low
- Each finding: file:line, description, remediation, status (Open / Fixed / Accepted Risk)
- Summary: total findings per severity, fixed vs open counts

### Step 4 — Update project-status.yaml

```yaml
artifacts:
  security_report:
    file: docs/security-report.md
    status: [Critical findings present | Clean]
    last_updated: [today's date]
```

### Step 5 — Next actions

If **Critical findings**:
→ List clearly, require fix immediately before deploying to any environment.

If **High findings**:
→ List, recommend fixing before merging to main.

If only **Medium/Low**:
→ Summarize, suggest fixing in priority order.

## Principles
- Classification: Critical / High / Medium / Low
- Each finding must have specific recommended fix
- Finding has status: Open | In Progress | Fixed | Accepted Risk
- DO NOT hardcode fix — propose remediation pattern, don't write replacement code