# Gsd Secure

> Security audit of changes; enforce defense in depth and OWASP best practices

- Skill: `aibot88/gsd-secure` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add aibot88/gsd-secure`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aibot88/gsd-secure/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: aibot88 (https://skillmd.com/u/aibot88)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/aibot88/gsd-secure

---


# GSD — Security Review

## When to Use
Mandatory step before shipping. Run the security quality dimension checklist against all changes.

## Steps

### Step 1: Identify Security-Touching Files
From REVIEW.md or git diff, list files that handle:
- Authentication/authorization
- Data persistence
- External API calls
- User input
- File operations
- Secrets management

### Step 2: Run Security Checklist
Check each security-touching file against the security quality dimension:
- Input validation on all boundaries
- Parameterized queries (no string concatenation)
- Proper output encoding
- Auth/authz checks on every endpoint
- No hardcoded secrets
- Secure defaults

### Step 3: Write SECURITY.md
```
# Security Review — Phase <N>

## Scope
<files reviewed>

## Findings

| ID | File | Issue | Severity | Status |
|----|------|-------|----------|--------|
| SEC-01 | | | | |

## Gate: PASS / FAIL
```

### Step 4: Fix Critical Findings
Any CRITICAL security issue must be fixed before proceeding. MAJOR/MINOR can be logged as technical debt.

## Exit Condition
SECURITY.md exists with Gate: PASS (or all CRITICAL findings fixed).