create-vasvibe 1.1.0 → 2.0.0

package/template/schemas/security-standards.template.md

@@ -0,0 +1,58 @@
+# SECURITY STANDARDS — [Project Name]
+
+**Owner Agent:** Security Expert (Mode Standards)
+**Date:** [YYYY-MM-DD HH:MM]
+**Phase:** Planning
+**Status:** `Draft` / `Approved`
+
+> Acuan standar keamanan proyek yang ditetapkan di awal. Semua engineer WAJIB mengikuti. Diverifikasi ulang oleh Security di fase Hardening. Perubahan lewat `_shared/change-management.md`.
+
+---
+
+## 1. Authentication & Authorization
+
+- **Auth mechanism:** [JWT / session / OAuth2 — pilih dan jelaskan]
+- **Password policy:** [hashing algo (bcrypt/argon2), min length, complexity]
+- **Token expiry:** [access token TTL, refresh token strategy]
+- **Authorization model:** [RBAC / ABAC — daftar role dan permission]
+
+## 2. Data Protection
+
+- **Encryption in transit:** TLS 1.2+ wajib
+- **Encryption at rest:** [field/tabel yang dienkripsi]
+- **PII handling:** [masking, minimization]
+- **Secrets management:** semua via env var, JANGAN hardcode; daftarkan di `.env.example`
+
+## 3. Input Validation & Output Encoding
+
+- Validasi semua input di server-side
+- Parameterized queries (anti SQL injection)
+- Output encoding (anti XSS)
+
+## 4. Security Headers & Config
+
+- CSP, HSTS, X-Frame-Options, X-Content-Type-Options
+- CORS policy: [origin yang diizinkan]
+- Rate limiting: [batas per endpoint sensitif]
+
+## 5. Compliance Requirements
+
+- [GDPR / UU PDP / PCI-DSS — jika relevan]
+
+## 6. Threat Model Summary
+
+[Threat utama yang diantisipasi sejak desain — referensi ke STRIDE jika sudah ada threat model.]
+
+## 7. Security Acceptance Criteria
+
+Checklist yang harus lulus sebelum release (diverifikasi Security di Hardening):
+- [ ] Tidak ada hardcoded secret
+- [ ] Semua endpoint ter-proteksi authz
+- [ ] Dependency bebas CVE critical/high
+- [ ] OWASP Top 10 ter-review
+
+## Revision History
+
+| Timestamp | Agen | Perubahan |
+|-----------|------|-----------|
+| [YYYY-MM-DD HH:MM] | Security | Initial security standards |

package/template/schemas/security_report.template.md

@@ -0,0 +1,89 @@
+# SECURITY REPORT - [TASK-ID / SCOPE]
+
+**Date:** [YYYY-MM-DD HH:MM]
+**Agent:** Security Expert Agent
+**Scope:** [Deskripsi scope yang diaudit — misal: "Fitur Login & Auth", "Seluruh codebase", "v1.2.0 release"]
+**Mode:** [A: Threat Model / B: Vulnerability Scan / C: Security Fix / D: Pre-release Audit]
+
+---
+
+## Executive Summary
+
+[Ringkasan singkat — apa yang diaudit, berapa temuan, dan rekomendasi utama.]
+
+**Overall Risk Level:** `CRITICAL` / `HIGH` / `MEDIUM` / `LOW` / `CLEAR`
+
+---
+
+## Findings
+
+### CRITICAL
+| # | Vulnerability | Location | Description | Recommendation |
+|---|---------------|----------|-------------|----------------|
+| 1 | | | | |
+
+### HIGH
+| # | Vulnerability | Location | Description | Recommendation |
+|---|---------------|----------|-------------|----------------|
+| 1 | | | | |
+
+### MEDIUM
+| # | Vulnerability | Location | Description | Recommendation |
+|---|---------------|----------|-------------|----------------|
+| 1 | | | | |
+
+### LOW / INFO
+| # | Vulnerability | Location | Description | Recommendation |
+|---|---------------|----------|-------------|----------------|
+| 1 | | | | |
+
+---
+
+## OWASP Top 10 Checklist
+
+- [ ] A01: Broken Access Control
+- [ ] A02: Cryptographic Failures
+- [ ] A03: Injection (SQL, XSS, Command)
+- [ ] A04: Insecure Design
+- [ ] A05: Security Misconfiguration
+- [ ] A06: Vulnerable & Outdated Components
+- [ ] A07: Authentication & Session Failures
+- [ ] A08: Software & Data Integrity Failures
+- [ ] A09: Security Logging & Monitoring Failures
+- [ ] A10: Server-Side Request Forgery (SSRF)
+
+---
+
+## Dependency Scan Results
+
+```
+[Output dari npm audit / pip audit / bundle audit]
+```
+
+**Vulnerable packages found:** [X critical, Y high, Z moderate]
+
+---
+
+## Secrets Scan Results
+
+- [ ] No hardcoded credentials found
+- [ ] No API keys in source code
+- [ ] `.env.example` does not contain real values
+- [ ] `.gitignore` covers all `.env` variants
+
+---
+
+## Fixes Applied
+
+| # | Vulnerability | Fix Description | Files Changed | Timestamp |
+|---|---------------|-----------------|---------------|-----------|
+| 1 | | | | |
+
+---
+
+## Sign-off
+
+- **Status:** `Pending Fix` / `All Clear` / `Conditional Approval`
+- **Remaining Issues:** [Daftar temuan yang belum di-fix dan alasannya — misal: "MEDIUM-1: accepted risk, ditangani di sprint berikutnya"]
+- **Next Action:** [Fix CRITICAL-1 sebelum deploy / Ready for release / dll]
+- **Reviewed By:** [Security Agent + Human approval jika sudah di-review]

package/template/schemas/specification.template.md

@@ -9,19 +9,49 @@
 ## User Story
 Sebagai [role], saya ingin [action], sehingga [benefit].
 
+## Technical Flow
+1. [Langkah 1 — contoh: User submit form login]
+2. [Langkah 2 — contoh: Backend validasi credentials]
+3. [Langkah 3 — contoh: Return JWT token]
+
 ## Acceptance Criteria
 - [ ] ...
+- [ ] ...
 
 ## API Contract
 ### [METHOD] /api/endpoint
-**Request:** ...
-**Response:** ...
+**Request:**
+```json
+{}
+```
+**Response (200):**
+```json
+{}
+```
+**Response (Error):**
+```json
+{}
+```
 
 ## Database Changes
-...
+(Tabel baru, kolom baru, atau index yang dibutuhkan — atau tulis "None")
 
 ## UI/UX
-...
+(Screenshot mockup, deskripsi komponen, atau link ke desain — atau tulis "None")
 
 ## Edge Cases & Validation
-...
+- [ ] ...
+
+---
+
+## Human Approval
+
+**Human Approval Status:** pending | approved | revision_requested
+
+**Human Feedback:**
+> (Kosongkan jika belum ada feedback. Analyst Agent akan mengisi berdasarkan masukan reviewer.)
+
+## Revision History
+| Date | Author | Changes |
+|------|--------|---------|
+| [YYYY-MM-DD] | Analyst Agent | Initial draft |

package/template/state/knowledge_base/requirements/.gitkeep

@@ -0,0 +1 @@
+# Keep this folder tracked by git