/devkit.generate-security-assessment

allowed-tools: Read, Write, Edit, Grep, Glob
argument-hint: "[language] [output-format]"
description: Generates comprehensive security assessment document after security audit completion. Use when you need to create a structured security report.

Overview

Generates comprehensive security assessment document after security audit completion. Use when you need to create a structured security report.

Usage

/devkit.generate-security-assessment $ARGUMENTS

Arguments

| Argument | Description | |----------|-------------| | `$ARGUMENTS` | Combined arguments passed to the command |

Execution Instructions

**Agent Selection**: To execute this generation task, use the following approach:

• Primary: Use `general-purpose` agent with specialized knowledge of the task domain
• Or use appropriate specialized agent if available for the specific generation task

Security Assessment Document Generation

**Target Project**: $ARGUMENTS

Document Analysis Setup

First, I'll analyze the project structure and security audit findings:

1. **Project Analysis**: Examine codebase structure and technologies 2. **Security Review**: Check recent security audit results 3. **Risk Assessment**: Identify critical security areas 4. **Compliance Check**: Verify regulatory requirements

Document Structure Generation

Based on security audit analysis, generating comprehensive assessment document with the following structure:

---

Security Assessment Document

**Language**: Language detection from arguments... **Format**: Output format configuration... **Generation Date**: Current timestamp...

1. Project Overview and Security Scope

Project Description

[Auto-generated based on codebase analysis]

**Identified Technologies**: [Framework detection from package.json/pom.xml] **Application Size**: [Lines of code, number of files] **Application Type**: [Web, API, Desktop, Mobile]

Security Scope

**Assessment Perimeter**:

• Authentication and Authorization
• Data Protection
• Security Architecture
• Incident Management

**Exclusions**: [Components not in scope]

2. Identity and Access Management

Authentication

[Analysis of authentication mechanisms]

• **Identified Methods**: JWT, OAuth2, Session-based
• **Security Configurations**: Spring Security, Passport.js, NextAuth
• **Two-Factor Authentication**: Implementation status
• **Password Policies**: Current password strength requirements

Authorization

[Access control analysis]

• **Role-Based Access Control (RBAC)**: Implementation status
• **Method-Level Security**: @PreAuthorize, @Secured annotations
• **API Protection**: Endpoint security configuration
• **Resource Access Control**: File and data access policies

Session Management

[Session security evaluation]

• **Session Timeout**: Current timeout configurations
• **Session Fixation Protection**: Security measures implemented
• **Concurrent Session Control**: Multiple session policies
• **Secure Cookie Configuration**: HttpOnly, Secure, SameSite settings

3. Data Protection

Encryption

[Cryptography implementation analysis]

• **Data in Transit**: TLS/SSL configurations
• **Data at Rest**: Database encryption, file system encryption
• **Algorithms Used**: AES, RSA, bcrypt for passwords
• **Key Management**: Secret storage and rotation policies

Data Masking

[Sensitive data handling]

• **PII Protection**: Personal identifiable information masking
• **Credit Card Data**: PCI-DSS compliance measures
• **Log Sanitization**: Sensitive data removal from logs
• **Database Field Encryption**: Column-level encryption

Backup and Recovery

[Data backup strategies]

• **Backup Schedule**: Automated backup frequency
• **Backup Encryption**: Encrypted backup storage
• **Recovery Testing**: Regular restore procedure validation
• **Disaster Recovery**: Business continuity planning

4. Threat Protection

Firewall and WAF

[Network security configuration]

• **Web Application Firewall**: Implementation status
• **Ingress/Egress Filtering**: Network traffic controls
• **DDoS Protection**: Rate limiting and traffic monitoring
• **API Gateway Security**: Request validation and filtering

Common Attack Protection

[Attack prevention measures]

• **SQL Injection**: Parameterized queries, ORMs usage
• **XSS Protection**: Input sanitization, CSP headers
• **CSRF Protection**: Anti-CSRF tokens
• **File Upload Security**: File type validation, virus scanning

Vulnerability Monitoring

[Security monitoring setup]

• **Dependency Scanning**: npm audit, OWASP Dependency Check
• **Static Analysis**: Code quality security tools
• **Dynamic Testing**: Security testing automation
• **Security Headers**: HSTS, X-Frame-Options, CSP

5. Code Security

Secure Development Guidelines

[Coding standards analysis]

• **Input Validation**: Validation frameworks usage
• **Error Handling**: Secure error response patterns
• **Security Libraries**: Cryptography, authentication libraries
• **Code Quality**: Static analysis tools integration

Code Review Process

[Security review practices]

• **Security Code Review**: Peer review for security
• **Automated Security Testing**: CI/CD security gates
• **Security Standards**: OWASP ASVS compliance
• **Documentation**: Security requirements documentation

Security Testing

[Security testing strategy]

• **Unit Tests Security**: Security-focused unit tests
• **Integration Tests**: End-to-end security validation
• **Penetration Testing**: Regular security assessments
• **Security Monitoring**: Runtime security monitoring

6. Incident Management

Incident Response Plan

[Incident response procedures]

• **Detection**: Security incident identification
• **Response**: Immediate response actions
• **Containment**: Incident containment strategies
• **Recovery**: Service restoration procedures

Reporting

[Incident reporting structure]

• **Logging Strategy**: Comprehensive logging setup
• **Audit Trails**: