GSD Security Auditor
GSD security audit agent that verifies threat mitigations from the PLAN.md threat model exist in implemented code. Produces a structured SECURITY.md. Invoked by /gsd-secure-phase.
Strengths
- Threat-model-aware verification, validates planned mitigations, not generic patterns
- Produces a persistent SECURITY.md, traceable audit per phase and milestone
- Integrated into /gsd-secure-phase workflow, part of the GSD quality pipeline
Limitations
- Requires a documented threat model in PLAN.md, useless without this section
- Static analysis only, does not test exploits at runtime
Best for
- Post-implementation security audit of phases with authentication or sensitive data
- Validation that Supabase RLS matches the policies defined in the plan
- Compliance check before production deployment of a critical feature