| name | security-review |
| description | Reviews Meridian security posture, including secrets, threat model, AI-agent safety, OWASP, dependencies and Git hygiene. Use for 02_security.md or security hardening. |
| allowed-tools | Read, Glob, Grep, Bash, Edit, Write |
Security review (Meridian)
Security before architecture and before agents execute sensitive work.
Selective reading
| File | When to read |
|---|
references/checklists.md | During full review or 02_security.md creation |
When to trigger
- Create or review
02_security.md
- Threat model, secrets, OWASP, supply chain request
- Before
05_architecture.md goes to approved
- Suspected agent violation (destructive command, leak)
Procedure
- Read
00_scope.md, 01_tech_stack.md, 03_user_types.md (context).
- Go through all sections of
references/checklists.md.
- Update
02_security.md with risks, mitigations, open items, out of scope.
- Register relevant decisions via
update-decisions-log.
- Do not weaken auth/validation/logging without explicit decision.
Result in 02_security.md
- Prioritized risks
- Security decisions
- Mitigations and open items
- Impact on architecture, database, API, environments
- AI agent posture for the project
Output
Security review:
02_security status:
Critical gaps:
Decisions logged:
Blocked until:
