meridiansecure-phaselisted

# /meridian:secure-phase — Security Phase Type Spawns 3 parallel subagents (OWASP threat modeler, auth analyst, data exposure analyst) for a phase that involves any user-facing surface, auth flows, or data handling. Produces `SECURITY.md` in the phase artifact directory. The plan phase soft-gates on this artifact for phases tagged as security-sensitive. **Position in workflow:** `secure-phase → spec-phase → discuss-phase → plan-phase → execute-phase` ## Arguments - (no args) — analyze the current pending/planned phase - `--phase <id>` — specify a phase by ID - `--skip-data` — skip the data exposure subagent (faster, 2 subagents only) - `--skip-security` — bypass gate warning in /meridian:plan (emergency only) ## Keywords security, owasp, threat model, auth, authentication, authorization, data exposure, pii, encryption, injection, xss, csrf, sql injection, secrets, tokens, pre-plan ## Procedure ### Step 1: Find Target Phase ```bash PYTHONPATH=$MERIDIAN_HOME uv run --project $MERIDIAN_HOME -- python -c " import json from scripts.db import connect, get_db_path from scripts.secure_phase import get_secure_context conn = connect(get_db_path('.')) ctx = get_secure_context(conn, phase_id=<phase_id_or_None>) print(json.dumps(ctx, indent=2, default=str)) conn.close() " ``` Pass the `--phase <id>` value as `phase_id`, or `None` if not specified. If result contains `"error"`, display it and stop — tell the user to run `/meridian:plan` first. Store: `phase_id`, `phase_name`, `