# Security Compliance

> Implement security scanning, vulnerability detection, and compliance checks. Use when working with security audits, dependency vulnerabilities, secret detection, CodeQL scanning, SAST/DAST tools, or security best practices. Handles threat modeling and security hardening. Use when this capability is needed.

- Skill: `tomevault-io/security-compliance` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/security-compliance`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/security-compliance/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/security-compliance

---


# Security & Compliance Guardian

## Mission
Maintain and enhance security posture for Brainarr through comprehensive scanning, vulnerability management, and compliance monitoring.

## Current Security Infrastructure
- ✅ **CodeQL Scanning**: Automated C# security analysis
- ✅ **Secret Detection**: Pre-commit hooks + GitLeaks
- ✅ **Dependency Scanning**: Dependabot automated updates
- ✅ **SBOM Generation**: Software Bill of Materials in releases
- ✅ **Artifact Signing**: Cosign keyless signing

## Expertise Areas

### 1. Static Application Security Testing (SAST)
- CodeQL query customization for C# and .NET
- Security code review automation
- Vulnerability pattern detection (injection, XSS, etc.)
- False positive management and suppression

### 2. Dependency Security
- Dependabot configuration optimization
- Vulnerability remediation strategies
- Supply chain attack prevention
- License compliance checking

### 3. Secret Management
- Credential scanning (GitLeaks, TruffleHog)
- Environment variable security
- Secrets rotation policies
- API key protection strategies

### 4. Container Security (Future)
- Image vulnerability scanning (Trivy, Grype)
- Base image hardening
- Runtime security monitoring
- Registry security policies

### 5. Compliance & Auditing
- SBOM generation and management
- Security audit trails
- Compliance reporting (OWASP, CWE)
- Penetration testing coordination

## Enhancement Opportunities
1. **Dynamic Analysis**: Add DAST for runtime vulnerability detection
2. **Container Scanning**: Scan Docker images when published
3. **Secrets Rotation**: Automate API key rotation
4. **Security Dashboards**: Centralized security metrics
5. **Threat Modeling**: Regular security architecture reviews

## Security Best Practices

### Code Security
- Input validation on all external data
- Parameterized queries (no SQL injection)
- Output encoding (prevent XSS)
- Secure cryptographic operations
- No hardcoded secrets

### Dependency Management
- Pin dependency versions
- Regular security updates
- Monitor transitive dependencies
- Review dependency changes in PRs

### API Security
- Authentication required for AI providers
- API key encryption at rest
- Rate limiting to prevent abuse
- Request/response validation

## Security Checklist
- [ ] No hardcoded secrets in code
- [ ] All dependencies up-to-date
- [ ] CodeQL findings addressed
- [ ] SBOM generated for releases
- [ ] Artifacts signed and verified
- [ ] Security advisories monitored
- [ ] Incident response plan documented
- [ ] Third-party audits completed

## Related Skills
- `code-quality` - Security is quality
- `release-automation` - Secure release processes
- `observability` - Security monitoring

## Examples

### Example 1: Review Security Scan Results
**User**: "Check the CodeQL findings and fix critical issues"
**Action**: Review security alerts, prioritize by severity, fix vulnerabilities, add suppressions for false positives

### Example 2: Update Vulnerable Dependency
**User**: "Dependabot found a critical vulnerability in Newtonsoft.Json"
**Action**: Review vulnerability details, test compatibility, update version, verify tests pass, merge PR

### Example 3: Implement Secret Scanning
**User**: "Add secret scanning to prevent API key leaks"
**Action**: Configure GitLeaks, add .gitleaks.toml, create pre-commit hooks, scan history, document process

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/richertunes) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-11 -->