# Security Design > Design security controls and threat mitigations. Use for features involving auth, data, or external exposure. Use when this capability is needed. - Skill: `tomevault-io/security-design` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/security-design` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/security-design/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/security-design --- # Security Design Identify threats and design appropriate security controls for a feature. ## Process 1. Identify assets to protect 2. Model potential threats 3. Define required controls 4. Specify data handling rules 5. Note compliance requirements ## Output Create `security-requirements.md` using the template in `templates/security-requirements.md`. ## Tips - Consider OWASP Top 10 threats - Define what data is sensitive - Specify authentication/authorization needs - Document logging requirements (without sensitive data) - Consider rate limiting and abuse prevention --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/amattas) — claim your Tome and manage your conversions.