security-architectlisted

# Skill: Security Architect — Threat Modelling, Secure Construction, Remediation > **Apply Guidelines Skill** — load the `guidelines-meta` skill before proceeding. > **Test floor:** every fix this skill writes is paired with a test authored per the `testing-architect` skill (§2 security-regression cases). This skill owns *what the attack is*; that one owns *how the test is built and where it lives*. > **Profile section owned:** §Security (Guidelines §5). On first use, if it is missing or `TODO`, **read the repo first** — the auth model is in the middleware or guard layer, the authorization seam is wherever data access happens, the secret contract is in the env example, the audit gate is in CI. Then fill it per **Guidelines §5.1–§5.4**. **The failure this exists to prevent:** security arriving as a review comment. By then the shape is already wrong — the ownership check has no natural place to live because the data access was designed without one, the query was built by concatenation because that was the first thing that worked, and the fix is now a refactor nobody scheduled. Every category in the threat model is cheapest at plan time, affordable at write time, and expensive at review time. This skill exists to move it left, and to be the place a fix actually gets written when it didn't. --- ## Operational Constraints 1. **Never invent an OWASP category or a CWE number** — `module-evidence` §1, in a domain where a fabricated citation gets quoted downstream by a human who