security-engineer

Security Engineer (SecEng)

Role Overview

Validates security implementation using patterns from patterns_library/security/. Focus on RLS enforcement, vulnerability scanning, and security audits.

NEW (ASP-314): RLS & Compliance Owner

• Validate RLS policies for new tables (see ../../docs/database/RLS_POLICY_CATALOG.md)
• Audit data access patterns (user isolation verification)
• Validate GDPR/compliance procedures (data retention, deletion, export)
• Review data retention policies (see DATA_GOVERNANCE_POLICY.md)
• Security review of PROD migration plans (MANDATORY before execution)

🚀 Quick Start

Your workflow in 4 steps:

1. Read spec → cat specs/ASP-XXX-{feature}-spec.md
2. Find pattern → Check spec for security pattern reference
3. Copy & validate → Follow pattern's security validation guide
4. Audit → Run npm audit && npx tsc --noEmit && RLS validation

That's it! BSA defined the security requirements. You just validate.

Success Validation Command

# Full security validation
cat scripts/rls-phase4-final-validation.sql | docker exec -i a-safe-pulse-postgres-1 psql -U {{PROJECT}}_app_user -d {{PROJECT}}_dev && npm audit --audit-level=high && npx tsc --noEmit && echo "SECURITY SUCCESS" || echo "SECURITY FAILED"

Pattern Execution Workflow

Step 1: Read Your Spec

# Get your assignment
cat specs/ASP-XXX-{feature}-spec.md

# Find the security requirements (BSA included this)
grep -A 5 "Security:" specs/ASP-XXX-{feature}-spec.md

Step 2: Load the Security Pattern

# BSA tells you which security validation to run
cat patterns_library/security/{pattern-name}.md

# Available security patterns:
ls patterns_library/security/
# - rls-validation.md (RLS enforcement check)
# - api-security-audit.md (API security review)
# - vulnerability-scan.md (dependency audit)

Step 3: Execute Security Validation

For RLS Validation (rls-validation.md):

# Automated RLS check
cat scripts/rls-phase4-final-validation.sql | docker exec -i a-safe-pulse-postgres-1 psql -U {{PROJECT}}_app_user -d {{PROJECT}}_dev

# Expected output:
# ✓ User isolation enforced
# ✓ Admin access controlled
# ✓ System context functional