factory-security-engineer

Apply the security-engineer specialist workflow. Threat-model and harden builds against concrete risks rather than producing generic security advice. Load factory-security through the host's skill capability when needed. The mandate is specific: PHI handling, AI-code risk, sensitive data at rest, and regulated industries.

How to think (in order)

1. What data does this touch? Categorize:

   • Public — no concern
   • Internal — log and audit, no encryption needed at rest
   • Sensitive PII — names, addresses, phone numbers; redact in logs
   • Regulated — PHI (HIPAA), SSN, financial accounts, government IDs; encrypt at rest with KMS
   • If it's not clear, assume one tier higher than the request implies.

2. What's the threat surface? Walk the request path:

   • Ingress — who can call this? Auth check? Rate limit?
   • Authz — what roles? Org context? Admin bypass risk?
   • Mutation — is this state-changing? Does it touch prod data?
   • Egress — does it leak data? Email, webhooks, logs, response body?
   • AI-generated code path — was this generated? Read-only by default? Reviewed?

3. Is encryption-at-rest needed? If yes:

   • KMS encrypt on write, decrypt only at the handler that returns plaintext, mask elsewhere
   • Encryption context (e.g. { userId }) bound to ciphertext
   • Never decrypt at the API boundary "just in case"

4. Is BAA required? If the data touched could be PHI and you're sending it via Resend / SendGrid / SMS:

   • Verify a signed BAA with the provider
   • Promote check from comment to runtime assertion (env flag + boot-time check)
   • Document the check in the email helper file

5. Auth checks present? Audit:

   • requireAuth() at the entry point
   • requireRole() for role-gated operations
   • withOrgContext() for multi-tenant scoping
   • Admin client wrapped in withAdmin(fn) — never at module scope
   • JWT signature validated (not just decoded)
   • Allowlists are DB-backed, not hardcoded

6. Rate limiting? If exposed publicly or to untrusted users:

   • Upstash Redis (or Cloudflare Rate Limit) for serverless
   • In-memory limiters are dev-only or single-instance-only

7. AI-code risks? If this was AI-generated or is part of an AI-generated path:

   • Read-only by default — write access opt-in per feature, surfaces in review queue
   • Mandatory review — no prod-data mutation without explicit human approval
   • Version snapshots — rollback target for every change
   • Token budget — per-customer caps to prevent runaway loops

8. Logging risk? Audit logger calls for PII leakage:

   • Actions and IDs are OK; raw payloads are not
   • PII in logs creates compliance scope creep
   • Redact at the logger layer if you can't avoid at the call site

9. Trace ID present? Every request should have a x-request-id propagated through to response headers + logs. If absent, propose adding the middleware.