「supply-chain」の検索結果

Audit Hex deps for supply-chain security risk — bidi chars, compile-time exec, maintainer changes, typosquats, CVEs. Use after mix deps.update, when checking if a package upgrade is safe, or reviewing mix.lock PR diffs.

日本語の概要は準備中です。原文の説明を表示しています。

Audit Hex deps for supply-chain security risk — bidi chars, compile-time exec, maintainer changes, typosquats, CVEs. Use after mix deps.update, when checking if a package upgrade is safe, or reviewing mix.lock PR diffs.

日本語の概要は準備中です。原文の説明を表示しています。

Identifies dependencies at heightened risk of exploitation or takeover. Use when assessing supply chain attack surface, evaluating dependency health, or scoping security engagements.

日本語の概要は準備中です。原文の説明を表示しています。

Typosquatting detection, install script analysis, dependency confusion prevention, and phantom dependency detection for npm/pip.

日本語の概要は準備中です。原文の説明を表示しています。

Software supply chain security — SBOM generation and analysis, dependency confusion and typosquatting detection, malicious package indicators, CI/CD pipeline hardening, and artifact provenance/signing (SLSA, Sigstore)

日本語の概要は準備中です。原文の説明を表示しています。

Use when reviewing, designing, or modifying Java enterprise systems from a maintainer-authored or maintainer-sanitized NIS2 engineering evidence inventory. Supports essential or important entities, critical-sector services, managed service providers, supply-chain dependencies, and cybersecurity incident escalation obligations without ingesting raw code, logs, runbooks, tickets, provider documents, or other operational free text. Part of Plinth Toolkit

日本語の概要は準備中です。原文の説明を表示しています。

Security: review git changes for vulnerabilities, threat-model a system's attack surface, audit supply-chain risks.

日本語の概要は準備中です。原文の説明を表示しています。

Use when attacking or auditing a CI/CD pipeline or software supply chain — pwn requests, poisoned pipeline execution, compromised/mutable-tag actions, dependency confusion, registry worms, runner backdoors, OIDC trust abuse, SLSA/provenance

日本語の概要は準備中です。原文の説明を表示しています。

Use when gaining initial access to a target — phishing, payload delivery, HTML smuggling, ISO/IMG/MOTW bypass, supply-chain, credential stuffing, exposed-service exploitation

日本語の概要は準備中です。原文の説明を表示しています。

Use when attacking an AI/ML system or model — prompt injection & jailbreaks (Crescendo, Skeleton Key, Best-of-N), RAG/vector poisoning, agentic/MCP exploitation (CVE-2025-54136), ML supply-chain RCE (pickle CVE-2025-32434), model extraction / membership inference / adversarial suffixes (GCG)

日本語の概要は準備中です。原文の説明を表示しています。

Use when auditing source code for vulnerabilities — drive CodeQL/Semgrep/Joern to taint untrusted data source-to-sink across injection, memory safety, deserialization/prototype-pollution, secrets/crypto/authz/race, and supply-chain risks

日本語の概要は準備中です。原文の説明を表示しています。

Applies NIST/CWE security hardening to Python and Rust code. Use when auditing code for vulnerabilities or proposing concrete security remediations.

日本語の概要は準備中です。原文の説明を表示しています。

Verifies a package exists before install, defending against hallucination and slopsquatting. Use when adding, recommending, or installing a package.

日本語の概要は準備中です。原文の説明を表示しています。

Threat-model product features, APIs, data flows, secrets, permissions, supply-chain changes, auth boundaries, and risky code paths before or during implementation. Use when touching authentication, authorization, payments, secrets, user data, uploads, webhooks, admin tools, innerHTML/eval/exec, dependency upgrades, or cross-tenant access.

日本語の概要は準備中です。原文の説明を表示しています。

Audit agent skills, plugins, prompts, manifests, scripts, dependencies, and bundled assets for provenance, prompt-injection, permission, execution, exfiltration, persistence, and update risk. Use when evaluating a third-party skill before installing, enabling, updating, publishing, or distributing it; reviewing an untrusted SKILL.md, agent configuration, MCP integration, archive, or repository; comparing a package with a known-good version; or investigating unexpected tool, network, credential, or filesystem behavior.

日本語の概要は準備中です。原文の説明を表示しています。

Supply chain mapping, supplier dependency analysis, customer concentration, geographic concentration, bottleneck identification, supply chain risk, logistics network, sourcing strategy, inventory management, vertical integration analysis

日本語の概要は準備中です。原文の説明を表示しています。

Test application security against OWASP Top 10 (2025) with automated CI tooling: OWASP ZAP (DAST), dependency/supply-chain scanning (OSV-Scanner, SBOM, provenance), Semgrep SAST, auth/session tests (JWT, OAuth, RBAC), and XSS/CSRF/SQLi/SSRF Playwright patterns. Use when: "security test," "OWASP," "vulnerability," "ZAP," "XSS," "SSRF," "dependency scan," "auth testing," "OWASP LLM Top 10." Scope is automated scanning + negative-path security tests in CI, not manual penetration testing. Not for: mapping security controls to regulations (SOC 2, HIPAA, PCI, GDPR) — use compliance-testing; pipeline stage wiring and deploy gating mechanics — use ci-cd-integration; purely functional API auth/input tests with no attacker model — see api-testing; testing your product's own LLM features or defending the agent itself (prompt-injection detector, indirect injection, jailbreak red-teaming) — use ai-system-testing. Related: ci-cd-integration, compliance-testing, api-testing, shift-left-testing, ai-system-testing.

日本語の概要は準備中です。原文の説明を表示しています。

Expert guidance for Cosign, the Sigstore tool for signing, verifying, and attaching metadata to container images and other OCI artifacts. Helps developers implement supply chain security by signing images in CI/CD, verifying signatures before deployment, and attaching SBOMs and vulnerability scan results as attestations.

日本語の概要は準備中です。原文の説明を表示しています。

供应链与生产运营 (供应链与生产运营 (Supply Chain & Production Operations) — 面向制造业与消费品实体供应链的『计划-制造-交付』运营判断,不是采购谈价技巧,也不是跨境电商发货物流。覆盖: (a) 第一性张力 — 这行的核心世界观分歧: **流动 > 局部效率(用有效产出/流动时间看系统,而不是用设备利用率/人均产出看工位;非瓶颈上的效率是幻觉) ⇄ 精益拉动 vs 推式预测(TPS/JIT 按下游消耗拉动、小批量平准化 vs MRP 按预测展开净需求推动;DDMRP 解耦缓冲是第三条路) ⇄ 精益/丰田 TPS 派 vs 约束理论 TOC 派(消除七大浪费、全局改善 vs 五步聚焦瓶颈、鼓-缓冲-绳 DBR 排产;两派互相指责对方浪费时间/只治标) ⇄ 变异是敌人(Deming/六西格玛/Factory Physics 的 VUT 排队论: 利用率越靠近满载排队时间越爆炸,交期长不是产能不够而是变异+高负荷) ⇄ 库存是负债 vs 库存是缓冲(会计把库存记成资产、精益视其为掩盖问题的水位、TOC 与韧性派视其为吸收变异的必要缓冲;真问题是缓冲放在哪一层而不是有没有) ⇄ 精益 JIT vs 韧性冗余(2020-2023 断链后 just-in-case、多源、近岸/友岸的回摆;精益派反驳崩的是『假精益』——单一来源+砍库存不砍变异) ⇄ 服务水平 vs 库存成本(安全库存/报童模型/ABC-XYZ 的经典取舍,牛鞭效应放大上游波动) ⇄ 成本导向压价 vs 供应商共生开发(Kraljic 分级、丰田供应商协会式长期共生 vs 年降指标与竞价) ⇄ 一个数 vs 各部门各算各的(S&OP/IBP 的本质是跨职能对齐到一套数字与一份产销计划))**; (b) 工具栈(此行的工具是『系统+方法』的混合) — ERP/MRP(SAP S/4HANA PP·MM、Oracle、用友·金蝶、Odoo、NetSuite)、APS 高级计划排程(Kinaxis RapidResponse、o9、Blue Yonder、SAP IBP、OMP、Siemens Opcenter APS)、MES/车间执行(Siemens Opcenter、Rockwell FactoryTalk、黑湖智造)、WMS/TMS、需求预测(统计模型 + Nixtla StatsForecast/Prophet、FVA 预测增值分析)、运筹优化与仿真(OR-Tools、Gurobi、Pyomo、AnyLogic、FlexSim、SimPy)、供应链风险与多级可视(Resilinc、Everstream、Interos)、分析层(SQL/Python pandas/Power BI)、以及纸笔工具(价值流图 VSM、A3、看板、标准作业票)—— 选型决策树的关键分岔是 MTS/MTO/ATO/ETO 履行模式与需求变异度,而非厂商功能清单; (c) 心智模型层 — 利特尔法则(在制品 = 产出率 × 流动时间)、瓶颈与非瓶颈、缓冲三态(库存/时间/产能缓冲)、解耦点(客户订单渗透点 CODP)、牛鞭效应、takt time 节拍与产线平衡、OEE 与六大损失、muda·mura·muri 三种浪费、自働化 jidoka 与安灯、防错 poka-yoke、SMED 快速换模换出小批量、平准化 heijunka、PDCA 与丰田改善型 Toyota Kata、DMAIC 与 Cpk 过程能力、报童模型与安全库存公式、ABC-XYZ 分级; (d) 工作流/SOP — 跑一轮月度 S&OP(需求评审→供应评审→预 S&OP→执行 S&OP)、做需求预测与预测误差复盘(MAPE/WMAPE/bias/FVA)、设定库存分级与安全库存、MRP 跑批与例外消息处理(缺料齐套与 MRP 神经质)、瓶颈识别与 DBR 排产、价值流图现状图→未来图→改善计划、新品导入 NPI 与多级 BOM/ECN 工程变更、供应商选择与开发(RFQ→审厂→APQP/PPAP→量产→年度绩效)、断料应急与交期承诺(ATP/CTP)、循环盘点与库存准确率; (e) 知识正典(en/ja 一手极厚,中译齐全) — 《目标 The Goal》Goldratt(TOC 小说体奠基)、《丰田生产方式》大野耐一、《改变世界的机器》Womack·Jones·Roos(MIT IMVP 研究)、《精益思想 Lean Thinking》Womack & Jones、《丰田模式 The Toyota Way》Liker、《工厂物理学 Factory Physics》Hopp & Spearman(排队论视角的运营科学)、《学习观察 Learning to See》Rother & Shook(VSM)、《丰田套路 Toyota Kata》Rother、Spear & Bowen 的 HBR 1999《Decoding the DNA of the Toyota Production System》、Lee/Padmanabhan/Whang 1997《The Bullwhip Effect in Supply Chains》、Ptak & Smith 的 DDMRP、Orlicky 的 MRP、Chopra & Meindl 的供应链管理教材、Deming《转危为安 Out of the Crisis》、Sheffi《The Resilient Enterprise》、ASCM/APICS 的 SCOR 参考模型与 CPIM/CSCP 知识体系; (f) 行业大佬/figures — 大野耐一(TPS 立法者)、新乡重夫(SMED/防错)、Eliyahu Goldratt(TOC 创立者)、W. Edwards Deming(变异与系统观)、James Womack & Daniel Jones(把 TPS 译成西方可学的『精益』)、Jeffrey Liker(丰田模式学术化)、Mike Rother(VSM 与改善型)、Wallace Hopp & Mark Spearman(工厂物理学)、Hau Lee(斯坦福,牛鞭效应与 Triple-A 供应链)、Yossi Sheffi(MIT,韧性)、Carol Ptak & Chad Smith(DDMRP)、David Simchi-Levi(MIT,风险敞口指数)、Steven Spear(TPS 的 DNA)、以及中文圈的供应链实务作者(刘宝红等); (g) 争议/批判(必须保留不洗白) — JIT 是不是 2021 全球断链的元凶(精益派反驳:崩的是单一来源+砍库存不砍变异的『假精益』);西方学精益的高失败率(只搬工具不搬思维,精益在很多工厂沦为裁员的代号);六西格玛黑带官僚化与扼杀创新之争;TOC 派与精益派互相攻击(Goldratt 讽刺精益是等浪费自己浮现);预测无用论(需求驱动派说预测必然错、要靠缓冲吸收)vs 统计预测派;控制塔/数字孪生/AI 预测的过度承诺与高项目失败率;中国制造的年降与内卷式压价 vs 供应商共生;近岸·友岸外包是真实产能转移还是政治叙事; (h) 流派/思想谱系 — **精益/TPS 派(丰田血统:大野-新乡→Womack/Jones/Liker/Rother,信全局消除浪费与人的改善能力)** vs **约束理论 TOC 派(Goldratt:系统产出只由瓶颈决定,聚焦五步、DBR、缓冲管理)** vs **统计质量/六西格玛派(Deming-Juran-Shewhart→GE/Motorola,信减少变异与过程能力)** vs **运营科学/工厂物理学派(Hopp & Spearman:用排队论与数学定律解释,认为精益与 TOC 都是特例)** vs **需求驱动/DDMRP 派(Ptak & Smith:预测不可靠,靠战略解耦缓冲)** vs **韧性/风险派(Sheffi、Simchi-Levi:效率之外必须为断链设计)**。不含: 跨境电商卖家的发货与头程物流(已由 cross-border-ecommerce 覆盖)、纯采购的商务谈判技巧、企业级 ERP 的代码实施与二次开发、通用项目管理。) Master OS — automated mastery of 供应链与生产运营 (Supply Chain & Production Operations) — 面向制造业与消费品实体供应链的『计划-制造-交付』运营判断,不是采购谈价技巧,也不是跨境电商发货物流。覆盖: (a) 第一性张力 — 这行的核心世界观分歧: **流动 > 局部效率(用有效产出/流动时间看系统,而不是用设备利用率/人均产出看工位;非瓶颈上的效率是幻觉) ⇄ 精益拉动 vs 推式预测(TPS/JIT 按下游消耗拉动、小批量平准化 vs MRP 按预测展开净需求推动;DDMRP 解耦缓冲是第三条路) ⇄ 精益/丰田 TPS 派 vs 约束理论 TOC 派(消除七大浪费、全局改善 vs 五步聚焦瓶颈、鼓-缓冲-绳 DBR 排产;两派互相指责对方浪费时间/只治标) ⇄ 变异是敌人(Deming/六西格玛/Factory Physics 的 VUT 排队论: 利用率越靠近满载排队时间越爆炸,交期长不是产能不够而是变异+高负荷) ⇄ 库存是负债 vs 库存是缓冲(会计把库存记成资产、精益视其为掩盖问题的水位、TOC 与韧性派视其为吸收变异的必要缓冲;真问题是缓冲放在哪一层而不是有没有) ⇄ 精益 JIT vs 韧性冗余(2020-2023 断链后

日本語の概要は準備中です。原文の説明を表示しています。

红队渗透 / 攻防 — 受授权的红队作业者 + 渗透测试工程师 + 攻击型安全顾问的认知操作系统 (侦察 OSINT / 外网渗透 / 内网 AD 渗透 BloodHound + Kerberoasting + ADCS 利用 + 横向移动 / Web 应用渗透 OWASP WSTG / 移动 OWASP MASTG / 云渗透 AWS Azure GCP IAM 路径 + 容器逃逸 + K8s / C2 操作 Cobalt Strike Sliver Mythic Havoc + OPSEC / 初始访问 + AV EDR 绕过 (仅授权场景) / 无线 RF / 物理社工 / 报告与整改 / 框架 MITRE ATT&CK + D3FEND + PTES + OSSTMM + NIST 800-115 + Kill Chain / 法律伦理 CFAA + 网络安全法 + 刑法 285 286 + 数据安全法 + GDPR + 授权书 + 范围 + 交战规则 — 不含 黑产 / 未授权攻击 / 大规模 exploitation / 供应链投毒 / 未授权 DoS — 这是 重罪 + 行业封杀 + 律师吊销, 本 skill 严守 authorized-only 边界 — 也不含 蓝队 SOC + 恶意软件 即服务 / 僵尸网络 / 勒索软件作者 — 这是 cybercrime 不是 红队) (Cybersecurity Red Team / Offensive Security Operations — the cognitive operating system of authorized red team operators, penetration testers, and offensive security consultants covering (a) reconnaissance & OSINT (passive + active discovery, asset surface mapping), (b) external network pentest (perimeter, exposed services, web), (c) internal network / Active Directory pentest (AD enumeration via BloodHound, Kerberos abuse — Kerberoasting / AS-REP-roasting / Unconstrained delegation / S4U2self, NTLM relay, ADCS abuse, GPO abuse, lateral movement, privilege escalation), (d) web application pentest (OWASP WSTG, authentication, authorization, SSRF, XXE, deserialization, SSTI, prototype pollution, GraphQL, JWT, API), (e) mobile pentest (OWASP MASTG, iOS / Android, instrumentation Frida / Objection, MASVS), (f) cloud pentest (AWS / Azure / GCP — IAM enumeration, privilege escalation paths, container escape, K8s RBAC, serverless), (g) C2 operations & post-exploitation (Cobalt Strike / Sliver / Mythic / Havoc, beacon ops, malleable profiles, OPSEC), (h) initial access & evasion (phishing infrastructure, payload development, AV / EDR evasion, BYOVD, AMSI / ETW bypass — strictly for authorized engagements), (i) wireless / RF (WPA2/3, evil twin, Wi-Fi pivots), (j) physical / social engineering (badge cloning, pretexting, vishing — under engagement letter), (k) reporting & remediation (executive summary, technical findings, CVSS, MITRE ATT&CK mapping, retest), (l) frameworks & methodology (MITRE ATT&CK, MITRE D3FEND, PTES, OSSTMM, NIST SP 800-115, OWASP WSTG / MASTG, Cyber Kill Chain, Unified Kill Chain, Diamond Model), (m) law & ethics (CFAA US, Computer Misuse Act UK, 中国 刑法 285/286 + 网络安全法 + 数据安全法, GDPR for tested EU systems, engagement letter, scope, rules of engagement, safe harbor for bug bounty); NOT criminal hacking / 黑产 / unauthorized targeting / mass exploitation / supply-chain compromise / DoS against unconsented systems (这是 重罪 + 业内开除 + 律师执照吊销, 本 skill 严守 authorized-only 边界), NOT pure defensive blue team / SOC analyst tradecraft (是 平行学科, 仅做 边界标注 + ATT&CK 反推方向), NOT malware-as-a-service development / botnet ops / ransomware authoring (是 cybercrime 不是 红队), NOT 'ethical hacking' 在 'just curious 看看' 自我合理化的灰色操作 (违反 authorization 原则即不是 红队).) Master OS — automated mastery of Cybersecurity Red Team / Offensive Security Operations — the cognitive operating system of authorized red team operators, penetration testers, and offensive security consultants covering (a) reconnaissance & OSINT (passive + active discovery, asset surface mapping), (b) external network pentest (perimeter, exposed services, web), (c) internal network / Active Directory pentest (AD enumeration via BloodHound, Kerberos abuse — Kerberoasting / AS-REP-roasting / Unconstrained delegation / S4U2self, NTLM relay, ADCS abuse, GPO abuse, lateral movement, privilege escalation), (d) web application pentest (OWASP WSTG, authentication, authorization, SSRF, XXE, deserialization, SSTI, prototype pollution, GraphQL, JWT, API), (e) mobile pentest (OWASP MASTG, iOS / Android, instrumentation Frida / Objection, MASVS), (f) cloud pentest (AWS / Azure / GCP — IAM enumeration, privilege escalation paths, container escape, K8s RBAC, serverless), (g) C2 operations & post-exploitation (Cobalt Strike / Sliver / Mythic / Havoc, beacon ops, malleable profiles, OPSEC), (h) initial access & evasi

日本語の概要は準備中です。原文の説明を表示しています。

DevOps 与站点可靠性工程 (SRE) — 平台 / 基础设施 / 可靠性工程师的认知操作系统, 覆盖软件交付 + 运维全生命周期 (CI/CD 与发布工程 trunk-based + 渐进式发布 canary/blue-green/feature flag + GitOps Argo CD/Flux / 基础设施即代码 Terraform/OpenTofu/Pulumi/Ansible + policy-as-code OPA / 容器与编排 Docker/Kubernetes + Helm/Kustomize + service mesh Istio/Linkerd / 可观测性 Prometheus + Loki + OpenTelemetry + Honeycomb + eBPF + RED/USE / SLO-SLI-error budget 与可靠性工程 Google SRE 学科 + 容量规划 + 优雅降级 / 事件管理与 on-call 事件指挥 + PagerDuty + runbook + 无指责复盘 + MTTR / 云平台与 FinOps AWS/GCP/Azure + 成本优化 + 弹性伸缩 / 平台工程与开发者体验 IDP + Backstage + golden path + Team Topologies / DevSecOps 与供应链安全 shift-left + SBOM + SLSA + sigstore + Vault / 韧性与混沌工程 fault injection + game day + 安全科学 / DORA 指标与工程效能 部署频率 + 变更前置时间 + 变更失败率 + Accelerate 研究 / 数据库与有状态运维 schema 迁移 + 备份容灾) — 不含 通用应用开发 / 纯云销售认证速成 / 'DevOps = 跑 Jenkins 的岗位' 窄化误解 / ITIL 工单文化传统运维 (旧范式仅做边界) / 把手工运维 ClickOps 当稳态 (是 toil, 本 skill 核心反模式) (DevOps & Site Reliability Engineering — the cognitive operating system of platform / infrastructure / reliability practitioners who own the full software delivery + operational lifecycle, covering (a) CI/CD & release engineering (build pipelines, trunk-based development, progressive delivery — canary / blue-green / feature flags, GitOps with Argo CD / Flux), (b) Infrastructure as Code (Terraform / OpenTofu, Pulumi, CloudFormation, Ansible, Crossplane — module design, state management, drift, policy-as-code OPA / Sentinel / Checkov), (c) containers & orchestration (Docker / OCI, Kubernetes — scheduling, networking CNI, storage CSI, operators / CRDs, Helm / Kustomize, service mesh Istio / Linkerd), (d) observability (the three pillars + beyond — metrics Prometheus / VictoriaMetrics, logs Loki / ELK, traces OpenTelemetry / Jaeger / Tempo, high-cardinality observability Honeycomb, eBPF, RED / USE methods, SLO-based alerting), (e) SLO / SLI / error budgets & reliability engineering (Google SRE discipline — service level objectives, error budget policy, toil budgets, capacity planning, load shedding, graceful degradation), (f) incident management & on-call (incident command, PagerDuty / Opsgenie, runbooks, blameless postmortems, MTTR / MTTD, error budget burn), (g) cloud platforms & FinOps (AWS / GCP / Azure well-architected, multi-region, cost optimization, autoscaling), (h) platform engineering & developer experience (internal developer platforms, Backstage, golden paths, self-service, Team Topologies), (i) DevSecOps & supply-chain security (shift-left, SAST / DAST, SBOM, SLSA, sigstore / cosign, secrets management Vault), (j) resilience & chaos engineering (chaos experiments, fault injection, game days, resilience engineering / safety science), (k) DORA metrics & engineering effectiveness (deployment frequency, lead time, change failure rate, MTTR, the Accelerate research), (l) databases & stateful operations (schema migrations, backups / DR, replication); NOT generic software development / app feature coding (是 平行学科, DevOps/SRE 关注 delivery + operability 不是 product feature), NOT pure cloud sales / certification cram without operational depth, NOT 'DevOps = a job title that runs Jenkins' 的窄化误解 (DevOps 是 文化 + 实践, SRE 是 Google 对 reliability 的工程化具体实现), NOT ITIL-heavy 传统运维 工单文化 (是 被 DevOps 取代的旧范式, 仅做边界标注), NOT manual ops / ClickOps as a steady state (是 toil, 本 skill 的核心反模式).) Master OS — automated mastery of DevOps & Site Reliability Engineering — the cognitive operating system of platform / infrastructure / reliability practitioners who own the full software delivery + operational lifecycle, covering (a) CI/CD & release engineering (build pipelines, trunk-based development, progressive delivery — canary / blue-green / feature flags, GitOps with Argo CD / Flux), (b) Infrastructure as Code (Terraform / OpenTofu, Pulumi, CloudFormation, Ansible, Crossplane — module design, state management, drift, policy-as-code OPA / Sentinel / Checkov), (c) containers & orchestration (Docker / OCI, Kubernetes — scheduling, networking CNI, storage CSI, operators / CRDs, He

日本語の概要は準備中です。原文の説明を表示しています。

A strict code reviewer, pair programmer, debugger, and mentor for Python, Bash, Google Apps Script, JavaScript, and Swift/Apple platforms. Use when writing, reviewing, debugging, planning, or securing code, or for senior-level rigor, a security review, or mentoring. Mode triggers — REVIEW: (critique + refactor), EXPLAIN: (teach), MVP:/PROTOTYPE: (lean-but-safe), DEBUG: (root-cause), AUDIT: (report-first); default is pair-programming. Drives a spec→plan→TDD→verify loop with a deterministic-first, verify-before-asserting (anti-hallucination) discipline. Enforces a security floor (secrets, injection, input validation, isolation, least privilege, authn) and a backup/continuity floor on a phase-aware rigor ladder (Prototype→MVP→Production) — cheap ≠ insecure. Covers testing & fuzzing, SAST/secret-scan/type-check/supply-chain gates, multi-tenant data protection, resilience & DR, scalability, CI/CD, cloud/containers/DBs, and accessible UI — deep references read on demand.

日本語の概要は準備中です。原文の説明を表示しています。

Vet a new or changed third-party dependency for license, provenance, and supply-chain risk before any install runs.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the diff adds, upgrades, re-sources or re-pins a dependency - manifests, lockfiles, go.mod replace, Docker base images, GitHub Actions uses, Terraform modules, submodules, vendored code or curl-pipe-sh installs

日本語の概要は準備中です。原文の説明を表示しています。