/sec

description: "Security umbrella: posture metrics, threat model, SBOM, incident workflow. Subcommands: status (default) | threat | sbom | incident | rotate."
argument-hint: "[subcommand] [args...] — default: status. Examples: /sec | /sec status 7 | /sec threat stripe-subscriptions | /sec sbom | /sec incident \"creds leaked\""
user-invocable: true
allowed-tools: Read, Write, Bash, Glob, Grep
model: sonnet

You are the great_cto security umbrella. This is the single entry point for all security workflows — metrics, threat modeling, SBOM generation, incident response.

Dispatcher

SUBCMD="${1:-status}"
shift 2>/dev/null || true  # remaining args are for subcommand
case "$SUBCMD" in
  status|threat|sbom|incident|rotate) ;;
  *)
    echo "Usage: /sec [subcommand] [args]"
    echo ""
    echo "  status [days]           — security posture metrics (default: 30d)"
    echo "  threat [arch-slug]      — STRIDE threat model for a feature"
    echo "  sbom [version]          — generate CycloneDX SBOM for release"
    echo "  incident \"<desc>\"       — security-incident workflow (DORA/GDPR)"
    echo "  rotate                  — show overdue secret rotations"
    echo ""
    echo "Unknown subcommand: $SUBCMD"
    exit 2 ;;
esac

**Routing:**

• `status` (or no args) → continue below (Steps 1-8 of metrics).
• `threat` → read `skills/great_cto/playbooks/threat-model.md` and follow its instructions end-to-end. Pass the remaining args ($1 = arch-slug).
• `sbom` → read `skills/great_cto/playbooks/sbom.md` and follow it. $1 = version (optional).
• `incident` → read `skills/great_cto/playbooks/security-incident.md` and follow it. $1 = description.
• `rotate` → jump directly to Step 5 below (secret rotation only), skip other metrics.

**For `threat`, `sbom`, `incident`**: the playbook files are the old `/threat-model`, `/sbom`, `/security-incident` commands — same content, now accessed via `/sec <sub>`. Read the file, then execute exactly as if it were the top-level command.

---

status subcommand — Security metrics aggregator

Compute the five security-posture metrics from artefacts produced by `security-officer`, `architect`, `devops`, and `/audit`. No external scanners, no new telemetry — only what already lives in the repo.

See `skills/great_cto/references/sec-metrics.md` for formula definitions and data-source documentation.

Setup

source .great_cto/env.sh 2>/dev/null || export PATH="/opt/homebrew/bin:$HOME/.local/bin:/usr/local/bin:$PATH"
# After `shift` above, $1 is now the first arg after the subcommand
PERIOD=${1:-30}
case "$PERIOD" in
  ''|*[!0-9]*) echo "Usage: /sec status [period_days]  (got: $PERIOD)"; exit 2 ;;
esac
NOW_EPOCH=$(date +%s)
WINDOW_START=$(( NOW_EPOCH - PERIOD * 86400 ))
SEC_BASELINE=.great_cto/sec-baseline.log
ARCHETYPE=$(grep "^archetype:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); ARCHETYPE=${ARCHETYPE:-web-service}

Step 0 — Current security tier

Reference: `skills/great_cto/references/security-tiers.md`. Compute effective tier from archetype + signals emitted by `senior-dev`.

case "$ARCHETYPE" in
  web3|iot-embedded|regulated)                   TIER_DEFAULT=deep ;;
  ai-system|commerce|infra)                      TIER_DEFAULT=standard ;;
  web-service|mobile-app|data-platform|library)  TIER_DEFAULT=baseline ;;
  *)                                             TIER_DEFAULT=baseline ;;
esac
TIER_OVERRIDE=$(grep "^default-tier:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}')
TIER_EFFECTIVE="${TIER_OVERRIDE:-$TIER_DEFAULT}"

SIGNAL_LOG=.great_cto/security-signals.log
SIGNALS_FIRED=""
if [ -f "$SIGNAL_LOG" ]; then
  for S in pci-dep-introduced crypto-dep-introduced auth-path-changed pii-field-added iac-perimeter-changed high-cve-in-dep external-ingest-added; do
    if grep -q "SECURITY_SIGNAL: $S " "$SIGNAL_LOG"; then
      SIGNALS_FIRED="$SIGNALS_FIRED $S"
      case "$TIER_EFFECTIVE" in baseline) TIER_EFFECTIVE=standard ;; esac
    fi
  done
fi

echo ""
echo "─ Current tier: $TIER_EFFECTIVE  (archetype=$ARCHETYPE default=$TIER_DEFAULT${TIER_OVERRIDE:+ override=$TIER_OVERRIDE})"
if [ -n "$SIGNALS_FIRED" ]; then
  echo "  Signals upgrading tier:"
  for S in $SIGNALS_FIRED; do echo "    · $S"; done
fi
echo ""

Helper: ISO8601 → epoch

iso_to_epoch() {
  python3 -c "import sys,datetime; print(int(datetime.datetime.fromisoformat(sys.argv[1].replace('Z','+00:00')).timestamp()))" "$1" 2>/dev/null || echo 0
}

Step 1 — CVE MTTR

Source: `docs/cve-log.md` — lines in format `YYYY-MM-DD | CVE-YYYY-NNNNN | severity | status | resolved:YYYY-MM-DD | note`.

CVE_LOG=docs/cve-log.md
CVE_MTTR_DAYS="-"
CVE_OPEN_CRITICAL=0
CVE_OPEN_OVERDUE_14D=0
if [ -f "$CVE_LOG" ]; then
  python3 - "$CVE_LOG" "$NOW_EPOCH" "$WINDOW_START" <<'PY'
import sys, datetime, statistics
path, now, window_start = sys.argv[1], int(sys.argv[2]), int(sys.argv[3])
durations = []
open_critical = 0
open_overdue = 0
with open(path) as f:
    for line in f:
        line = line.strip()
        if not line or line.startswith("#"): continue
        parts = [p.strip() for p in line.split("|")]
        if len(parts) < 4: continue
        try:
            advisory = int(datetime.datetime.fromisoformat(parts[0]).timestamp())
        except Exception:
            continue
        severity = parts[2].lower() if len(parts) > 2 else ""
        status = parts[3].lower() if len(parts) > 3 else ""
        resolved_ts = None
        for p in parts[4:]:
            if p.startswith("resolved:"):
                try:
                    resolved_ts = int(datetime.datetime.fromisoformat(p.split(":",1)[1]).timestamp())
                except Exception: pass
        if status == "open":
            if severity == "critical":
                open_critical += 1
            if (now - advisory) / 86400 > 14:
                open_overdue += 1
        elif resolved_ts and advisory >= window_start - 90*86400:
            # include resolved CVEs in a 90-day m