# Security Engineering

> Use when a SEED Unit has security constraints (authn/authz, tenant isolation, input validation, secrets, OWASP). Invoked by spec-driven-development / seed-unit when security constraints apply.

- Skill: `inapp-inc/security-engineering` (Agent Skill)
- Install (CLI): `npx skillmds@latest add inapp-inc/security-engineering`
- Raw SKILL.md: https://api.skillmd.com/api/skills/inapp-inc/security-engineering/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: inapp-inc (https://skillmd.com/u/inapp-inc)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/inapp-inc/security-engineering

---


# Security engineering

Ensure SEED Units and design artifacts include explicit **security requirements**, validation, and evidence.

## Core rules

- Authn/authz and tenant isolation are first-class when applicable.
- Prefer deny by default; safe errors (no enumeration/leakage).
- Require evidence: security tests, static checks, or reviewable proofs.
- Close each touching slice with an OWASP Top 10 check (or `N/A — <rationale>` under Sprint Mode when not applicable).
- If APIs change, ensure **`Docs/openapi.yaml`** reflects auth requirements.
- **Hard enforcement (manual PR operations):** do not create/update/merge PRs.

## Required outputs

- Security constraints + AC + evidence on the SEED Unit block
- Security decisions in `design.md` (threats, mitigations, residual risk)

## Minimum checklist

- Input validation & injection safety
- Authn/authz correctness
- Data isolation / least privilege
- Secrets handling (env/config only)
- Safe logging (no sensitive payloads)