showdar-securitylisted

# Showdar Security ## Purpose - Perform evidence-backed security analysis, threat modeling, secure-design review, and implementation-security guidance. - Follow sensitive data from requirements, code, configuration, architecture, dependencies, and runtime boundaries to its security outcome. - Produce practical findings with affected assets, trust boundaries, impact, exploitability, remediation, residual risk, and verification. - Use `data/security-patterns.csv` as a focused prompt set and load `references/threat-modeling.md` when modeling a larger flow. ## When to use - The user asks for a threat model, security posture review, attack-surface map, or secure-design review. - A change involves authentication, authorization, sessions, tokens, secrets, credentials, sensitive data, storage, URLs, files, IPC, or permissions. - The user asks to review an API for authz, IDOR/BOLA, injection, SSRF, XSS, CSRF, or data exposure risk. - A mobile flow involves deep links, WebViews, local storage, biometrics, app lifecycle, or Android/iOS permission boundaries. - A backend, desktop, dependency, supply-chain, or security-configuration change needs a security regression assessment. ## When not to use - Do not use this for general correctness, maintainability, architecture, performance, or test review; use `showdar-review`. - Do not use this to diagnose the root cause of an observed crash or failure; use `showdar-debug`. - Do not implement automated tests; use `showdar-test`. Do not own