aiws-sdd-audit-security

name	aiws-sdd-audit-security
description	Audit a REASONS spec/app against a catalogue of security controls (SEC-*). Trigger: security review or before approving a spec for deployment.
license	Apache-2.0
metadata	{"author":"ai-workspace","version":"1.0"}

aiws-sdd-audit-security — security audit (SEC-*)

Audit a reasons spec and its code against a catalogue of security controls. Cite findings by control ID. The full SEC-* catalogue is an external reference (supply your own; not bundled here); the blocking checks below are the most frequent rejects and must be verified first.

Blocking checks

• SEC-NET — every outbound HTTP call declares an explicit timeout (SEC-NET-001 is the #1 reject); Profile B with a Node server binds 127.0.0.1 only (SEC-NET-003).
• SEC-DATA — handles_personal_data: true ⇒ §7.2 has legal basis, retention, data-subject rights, DPO (GDPR/LOPDGDD). No personal data in browser storage.
• SEC-STOR — browser localStorage/sessionStorage holds only non-personal preferences (SEC-STOR-001/002).
• SEC-RUNTIME — Profile B has no server-held secrets unless runs_node_server: true; then secrets live outside the package, loaded via env (SEC-RUNTIME-001/002).
• SEC-DEPS — dependencies scanned (uv audit / npm audit); no floating ranges on security-sensitive deps (SEC-DEPS-003/004).
• SEC-XSS / SEC-CSP — React/SPA paths apply the XSS and CSP rules (SEC-XSS-003/004, SEC-CSP-003).

Output

A report listing each control checked, PASS/FAIL, and the spec/code location. All audits green is a precondition for the it-approved status transition.