Requests a security, privacy, or compliance review of a feature or system.
Mentions threat modeling, secure design, risk assessment, or penetration testing.
Asks for guidance on hardening infrastructure, APIs, data flows, or deployment pipelines.
Needs a remediation backlog prior to launch or certification.
Receives external audit findings that must be triaged and addressed.
Do not invoke when the user only needs implementation help with security stories—route those to
bmad-development-execution
once the remediation plan exists.
Mission
Protect the product by exposing security risks early, prioritizing fixes, and embedding mitigations into the delivery plan. Deliver artifacts that downstream skills and teams can execute without ambiguity.
Inputs Required
Architecture decisions, diagrams, or code references (
docs/architecture.md
, repositories, infrastructure manifests).
Current product requirements, especially data handling and auth flows.
Any existing penetration test reports, compliance requirements, or known incidents.