[Extension]: Add Security Review v2.0.0 #4217

Extension ID

security-review

Extension Name

Security Review

Version

2.0.0

Description

Full-project secure-by-design security audits plus staged, branch/PR, plan, task, follow-up, and apply reviews

Author

DyanGalih

Repository URL

https://github.com/DyanGalih/security-review

Download URL

https://github.com/DyanGalih/security-review/archive/refs/tags/v2.0.0.zip

License

MIT

Homepage (optional)

https://github.com/DyanGalih/security-review

Documentation URL (optional)

https://github.com/DyanGalih/security-review/blob/main/docs/usage.md

Changelog URL (optional)

https://github.com/DyanGalih/security-review/blob/main/CHANGELOG.md

Required Spec Kit Version

=0.1.0

Required Tools (optional)

• Node.js (>=22.0.0) - optional for standalone CLI (security-review), LLM prompts execute natively
• git (>=2.0.0) - required

Number of Commands

10

Number of Hooks (optional)

3

Tags

security, audit, owasp, compliance, governance

Key Features

• Full-project secure-by-design audits (speckit.security-review.audit)
• Git branch & PR diff analysis (speckit.security-review.branch)
• Staged change review (speckit.security-review.staged)
• Spec-Kit plan and task verification (speckit.security-review.plan, speckit.security-review.tasks)
• Automated remediation planning and task application (speckit.security-review.followup, speckit.security-review.apply)
• Finding re-verification with safe Proof-of-Concept generation (speckit.security-review.verify)
• Executive & Pentest Report export (speckit.security-review.export)
• Project Security Constitution initialization (speckit.security-review.init)

Testing Checklist

• Extension installs successfully via download URL
• All commands execute without errors
• Documentation is complete and accurate
• No security vulnerabilities identified
• Tested on at least one real project

Submission Requirements

• Valid extension.yml manifest included
• README.md with installation and usage instructions
• LICENSE file included
• GitHub release created with version tag
• All command files exist and are properly formatted
• Extension ID follows naming conventions (lowercase-with-hyphens)

Testing Details

Tested on:

• Linux (Ubuntu 24.04) with Spec Kit >= v0.1.0
• macOS (Sequoia) with Spec Kit >= v0.1.0

Test project: Tested across brownfield TypeScript/JavaScript repositories and Spec-Kit SDD workflows.

Test scenarios:

1. Installed extension via specify extension add security-review --from https://github.com/DyanGalih/security-review/archive/refs/tags/v2.0.0.zip
2. Verified all 10 command markdown definitions and 3 lifecycle hooks (after_plan, after_tasks, after_implement).
3. Executed audit, branch diff, staged diff, plan, tasks, followup, apply, verify, and export commands.
4. Validated frontmatter schema validation and report outputs in docs/security-reviews/.

Example Usage

# Install extension
specify extension add security-review --from https://github.com/DyanGalih/security-review/archive/refs/tags/v2.0.0.zip

# Run a full security audit
/speckit.security-review.audit

# Review a feature branch against main
/speckit.security-review.branch

# Verify findings and generate reproduction PoCs
/speckit.security-review.verify

Proposed Catalog Entry

{
  "security-review": {
    "name": "Security Review",
    "id": "security-review",
    "description": "Full-project secure-by-design security audits plus staged, branch/PR, plan, task, follow-up, and apply reviews",
    "author": "DyanGalih",
    "version": "2.0.0",
    "download_url": "https://github.com/DyanGalih/security-review/archive/refs/tags/v2.0.0.zip",
    "repository": "https://github.com/DyanGalih/security-review",
    "homepage": "https://github.com/DyanGalih/security-review",
    "license": "MIT",
    "requires": {
      "speckit_version": ">=0.1.0"
    },
    "provides": {
      "commands": 10,
      "hooks": 3
    },
    "tags": ["security", "audit", "owasp", "compliance", "governance"],
    "verified": false,
    "downloads": 0,
    "stars": 0,
    "created_at": "2026-08-20T00:00:00Z",
    "updated_at": "2026-08-20T00:00:00Z"
  }
}

Additional Context

Release v2.0.0 modernizes the extension with centralized configuration in .security-review/, automatic discovery of latest reports in docs/security-reviews/, improved branch diff parsing, and new finding re-verification and PoC generation capabilities.