ai-security

# Security Scanning ## Quick start ``` /ai-security all # full sweep (static + deps + secrets + sbom) /ai-security deps # dependency audit only /ai-security secrets # gitleaks scan /ai-security sbom # CycloneDX SBOM for compliance /ai-security --fix # auto-remediate where safe ``` Unified security assessment for regulated industries. Modes: `static` (SAST with semgrep), `deps` (pip-audit/npm audit), `secrets` (gitleaks), `sbom` (CycloneDX). Zero tolerance for medium+ findings. Each finding includes severity, location, fix suggestion, and CWE reference. ## When to Use - Security review, pre-release gate, dependency audit, compliance reporting. - NOT for code quality metrics -- use `/ai-verify quality`. - NOT for governance compliance -- use `/ai-governance`. ## Process Step 0 (load contexts): read `.ai-engineering/manifest.yml` `providers.stacks`; load `.ai-engineering/overrides/<stack>/conventions.md` for each stack and `.ai-engineering/overrides/_shared/conventions.md`; load `.ai-engineering/team/*.md` for team conventions. ## Modes ### all -- Full Scan (default) The `all` mode runs static, deps, and secrets in sequence and produces an aggregated report. This is the default when `/ai-security` is invoked without a mode argument. ### static -- SAST 1. **Read stacks** -- read `.ai-engineering/manifest.yml` field `providers.stacks` for active languages. 2. **Secret detection** -- `gitleaks detect --source . --no-git`. Any finding is critical. N...