@rasensio/aidlc-content 1.15.0 → 1.15.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rasensio/aidlc-content",
-  "version": "1.15.0",
+  "version": "1.15.1",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/skills/50-testing.md

@@ -57,6 +57,22 @@ Verify that the implementation satisfies all acceptance criteria. Produce eviden
 {{context:style-guide}}
 {{guidance:secure-defaults}}
 
+## Security Testing
+
+When the work under test touches a trust boundary (user input, auth, file paths,
+subprocess or query construction, deserialization), the suite MUST include
+negative security tests, not only happy paths:
+
+- Inputs crafted to escape the intended context: injection payloads for shell,
+  SQL, path (`../`), and template sinks the code actually has
+- Requests without credentials, and with valid credentials for the WRONG user or
+  role, asserting they are rejected
+- Malformed and boundary inputs (empty, oversized, wrong type) asserting safe
+  failure — no stack traces or internals in the response
+
+Run the project's dependency audit (e.g. `npm audit`, `pnpm audit`) once per
+testing phase and record newly introduced advisories as findings.
+
 ## Security Confirmation
 
 If testing requires:

package/skills/60-deployment.md

@@ -14,7 +14,9 @@ Prepare and execute the release. Ensure all preceding phases are complete, all g
 
 - All preceding required phases have status `complete` in `.aidlc/state/<instance>/`
 - Testing phase complete with all tests passing
-- Security sign-off recorded (if a security review phase is configured)
+- The review findings file has no open `critical` security finding (the adversarial
+  review's security dimension is the sign-off; no template configures a separate
+  security review phase)
 - The instance is claimed by this session
 
 ## Required Artifacts

package/skills/80-review.md

@@ -36,7 +36,11 @@ You MUST perform this review with fresh eyes. If you authored the artifact being
    - **Missing edge cases** — Inputs, states, or scenarios not addressed
    - **Untestable criteria** — Requirements with no observable pass/fail
    - **Hidden assumptions** — Unstated preconditions the artifact relies on
-   - **Security gaps** — Missing auth, unvalidated input, exposed data
+   - **Security gaps** — Missing auth, unvalidated input, exposed data. When the
+     instance has implementation code (a branch or diff), review the CODE for this
+     dimension, not only the markdown artifacts: injection sinks (shell, SQL, path,
+     template), secrets in source, missing authorization checks, and unsafe
+     deserialization. Apply the secure-defaults guidance below as the checklist.
    - **Scalability concerns** — Performance bottlenecks or resource limits
    - **Scope creep** — Functionality beyond the stated scope
 3. **Write findings.** For each issue found, record:
@@ -47,6 +51,8 @@ You MUST perform this review with fresh eyes. If you authored the artifact being
    - **Status**: `open` (always for new findings)
 4. **Save the findings file** as `<artifact>.review.md` in the instance namespace.
 
+{{guidance:secure-defaults}}
+
 ## Findings Format
 
 ```markdown