security-audit-secure-sdlc
Activate when assessing security posture, performing threat modelling, reviewing secure coding practices, evaluating dependency hygiene, auditing secrets management, designing security gates for CI/CD pipelines, or mapping practices to compliance frameworks (NIST SSDF, OWASP, SOC 2). Use for security architecture reviews, STRIDE analysis, SAST/DAST/SCA tool selection, secure design principle enforcement, vulnerability triage, penetration test scoping, supply chain security, build integrity, and producing security findings reports. Covers both proactive design-time security and reactive incident-response readiness.
Repository SourceNeeds Review
ai-assisted-engineering
Activate when engineers want to use AI tools more effectively in daily work — coding, review, debugging, refactoring, test generation. Use when establishing team norms for AI tool use, reviewing AI-generated code for correctness and security, diagnosing why AI tool results are poor quality, or deciding which tasks belong to Claude vs Cursor/Copilot vs human. Applies to Claude Code, Cursor, GitHub Copilot, MCP integrations, and agentic coding workflows.
Repository SourceNeeds Review
devops-pipeline-governance
Activate when designing or reviewing CI/CD pipelines, evaluating pipeline security and integrity, defining deployment strategies, establishing environment promotion policies, setting up release automation, governing infrastructure-as-code practices, defining rollback procedures, or troubleshooting pipeline failures blocking a release. Use for pipeline architecture, build reproducibility, deployment safety, environment parity, and the controls that ensure only reviewed and tested code reaches production.
Repository SourceNeeds Review
feature-flag-lifecycle
feature flag, flag lifecycle, flag debt, flag cleanup, stale flags, release flag, flag registry, rolling out a flag, flag removal, dark launch, kill switch, gradual rollout, flag expiry, flag audit, feature toggle
Repository SourceNeeds Review