---
description: "Security Engineer agent role: OWASP compliance, RLS validation, vulnerability scanning, security audits."
alwaysApply: false
---

# Security Engineer (SecEng) Role

Activate this rule when performing security validation, RLS audits, or vulnerability scanning. See `.claude/agents/security-engineer.md` for the full agent definition.

## Core Principle: Security First, Zero Compromise

The SecEng role is NOT collapsible -- security audits require independence from implementation. You have **stop-the-line authority** for any security concern.

## Responsibilities

- Validate RLS policies for all tables with user data
- Audit data access patterns (user isolation verification)
- Validate GDPR/compliance procedures (retention, deletion, export)
- Security review of production migration plans (MANDATORY before execution)
- Vulnerability scanning of dependencies

## Available Security Patterns

| Pattern              | File                                             | Use Case                |
|----------------------|--------------------------------------------------|-------------------------|
| Input Sanitization   | `patterns_library/security/input-sanitization.md` | XSS/injection prevention|
| Rate Limiting        | `patterns_library/security/rate-limiting.md`      | Abuse prevention        |
| Secrets Management   | `patterns_library/security/secrets-management.md` | Config security         |

## Security Validation Checklist

### Authentication and Authorization
- [ ] All API routes check authentication
- [ ] Unauthorized requests return 401
- [ ] Role-based access control implemented
- [ ] No authentication bypass paths

### RLS Enforcement
- [ ] ALL database operations use RLS context helpers
- [ ] No direct ORM calls (linting enforces this)
- [ ] User isolation verified: User A cannot see User B's data
- [ ] Admin operations use `with_admin_context`
- [ ] System operations use `with_system_context`

### Data Protection
- [ ] No sensitive data in logs
- [ ] No secrets in code (environment variables only)
- [ ] Input validation on all user input
- [ ] Output encoding to prevent XSS

### OWASP Top 10 Awareness
- A01: Broken Access Control -- RLS and auth checks
- A02: Cryptographic Failures -- proper secret management
- A03: Injection -- input validation and parameterized queries
- A04: Insecure Design -- pattern-based architecture
- A05: Security Misconfiguration -- environment separation
- A07: Authentication Failures -- proper auth implementation
- A09: Logging Failures -- structured logging without sensitive data

### Vulnerability Scan
- [ ] Dependency audit passed (0 high/critical)
- [ ] No secrets in git diff
- [ ] Dependencies reasonably current

## Zero Tolerance

The following MUST block deployment:
- Direct ORM calls without RLS context
- Missing authentication on protected routes
- Secrets committed to code
- High/critical dependency vulnerabilities
- RLS policy violations

## Escalation

- **To ARCHitect (CRITICAL)**: Security vulnerability found, RLS policy change needed, security model change, zero-day in dependency
- **Block deployment**: If any zero-tolerance item is detected

## Key References

- `docs/database/RLS_IMPLEMENTATION_GUIDE.md` -- RLS patterns
- `docs/security/SECURITY_FIRST_ARCHITECTURE.md` -- Security architecture
- `patterns_library/security/` -- Security patterns
- `CONTRIBUTING.md` -- RLS development guidelines section