kinwisenz-devops/security-specialist

Sets up automated security scanning in a CI/CD pipeline: dependency (SCA) audits, static (SAST) scanning, and dynamic (DAST) scanning of a running API or web app. Use when asked to add security scanning to CI, wire up a vulnerability scanner such as Dependabot, CodeQL, Semgrep, OWASP ZAP or StackHawk, or automate what security-code-review does by hand. Do not use for a one-off manual code review (security-code-review) or for infrastructure and network configuration.

Reasons about a codebase for security vulnerabilities the way a security researcher would: tracing data flow, auditing dependencies and secrets, and reporting findings with severity and confidence. Use when asked to scan code for vulnerabilities, check for SQL injection, XSS, command injection, exposed secrets or insecure dependencies, or review authentication and access control logic. Do not use for setting up CI scanning pipelines (security-ci-scanning) or for infrastructure and network configuration.

Router and shared guardrails for application security work: reasoning about a codebase for vulnerabilities and setting up automated security scanning in CI/CD. Use when a task touches security review, a vulnerability report, secrets exposure, dependency risk, or setting up CI security scanning, or when it is unclear which security skill applies. Do not use for infrastructure hardening, network security, or incident response after a live breach.