aiw-security-testinglisted

# Security Testing Read this file when the change touches a trust boundary or handles input the system cannot trust. This file contains rules for writing automated security tests before deferring to manual review or assuming framework guarantees. ## Related Workflow Sections This skill works alongside these workflow sections. Consult them when writing security tests: - **Non-Functional Dimensions**: defines when automated coverage must be attempted before manual verification. - **aiw-testing**: general test construction rules. This skill covers the security-specific subset. - **aiw-failure-analysis**: covers what to do when a reported behaviour contradicts what a security test claims. ## When This Skill Applies The triggers below are broader than they look: any change to input handling, even a cosmetic one, can cross a trust boundary. Load this skill when the change does any of the following: - Adds, modifies, or removes an authentication or session check. - Adds, modifies, or removes an authorisation rule (role check, ownership check, scope check). - Reads, validates, parses, or transforms input from a user, the network, or an untrusted file. - Constructs a file path, shell command, SQL query, HTML fragment, or any other string that will later be interpreted by a parser or shell. - Reads, writes, transmits, or logs a secret: password, API key, token, signing key, or personally identifying data. - Calls an external API, including hidden retries, callbacks, and webhook