Security Health Check (Inline Orchestration)

You ARE the orchestrator. Execute this workflow directly without spawning a separate orchestrator agent.

Workflow Overview

Beads Init → Detection → Create Issues → Fix by Priority → Close Issues → Verify → Beads Complete

Max iterations: 3 Priorities: critical → high → medium → low Beads integration: Automatic issue tracking

Phase 1: Pre-flight & Beads Init

1. Setup directories:

``bash mkdir -p .tmp/current/{plans,changes,backups} ``

1. Validate environment:

- Check package.json exists - Check type-check and build scripts exist

1. Create Beads wisp:

``bash bd mol wisp exploration --vars "question=Security vulnerability scan" ``

IMPORTANT: Save the wisp ID (e.g., mc2-xxx) for later use.

1. Initialize TodoWrite:

``json [ {"content": "Security scan", "status": "in_progress", "activeForm": "Scanning for vulnerabilities"}, {"content": "Create Beads issues", "status": "pending", "activeForm": "Creating issues"}, {"content": "Fix critical vulnerabilities", "status": "pending", "activeForm": "Fixing critical vulnerabilities"}, {"content": "Fix high priority vulnerabilities", "status": "pending", "activeForm": "Fixing high vulnerabilities"}, {"content": "Fix medium priority vulnerabilities", "status": "pending", "activeForm": "Fixing medium vulnerabilities"}, {"content": "Fix low priority vulnerabilities", "status": "pending", "activeForm": "Fixing low vulnerabilities"}, {"content": "Verification scan", "status": "pending", "activeForm": "Verifying fixes"}, {"content": "Complete Beads wisp", "status": "pending", "activeForm": "Completing wisp"} ] ``

Phase 2: Detection

Invoke security-scanner via Task tool:

subagent_type: "security-scanner"
description: "Detect all vulnerabilities"
prompt: |
  Scan the entire codebase for security vulnerabilities:
  - SQL injection
  - XSS vulnerabilities
  - Authentication/authorization issues
  - RLS policy violations
  - Hardcoded secrets
  - Insecure dependencies
  - Categorize by priority (critical/high/medium/low)

  Generate: security-scan-report.md

  Return summary with vulnerability counts per priority.

After security-scanner returns:

1. Read security-scan-report.md
2. Parse vulnerability counts by priority
3. If zero vulnerabilities → skip to Phase 7 (Final Summary)
4. Update TodoWrite: mark detection complete

Phase 3: Create Beads Issues

For each vulnerability found, create a Beads issue:

# Critical (P0) - Security critical gets highest priority
bd create "SECURITY: {vuln_title}" -t bug -p 0 -d "{description}" \
  --deps discovered-from:{wisp_id}

# High (P1)
bd create "SECURITY: {vuln_title}" -t bug -p 1 -d "{description}" \
  --deps discovered-from:{wisp_id}

# Medium (P2)
bd create "SECURITY: {vuln_title}" -t bug -p 2 -d "{description}" \
  --deps discovered-from:{wisp_id}

# Low (P3)
bd create "SECURITY: {vuln_title}" -t bug -p 3 -d "{description}" \
  --deps discovered-from:{wisp_id}

Add security label:

bd update {issue_id} --add-label security

Track issue IDs in a mapping for later closure.

Update TodoWrite: mark "Create Beads issues" complete.

Phase 4: Quality Gate (Pre-fix)

Run inline validation:

pnpm type-check
pnpm build

• If both pass → proceed to fixing
• If fail → report to user, exit

Phase 5: Fixing Loop

For each priority (critical → high → medium → low):

1. Check if vulnerabilities exist for this priority

- If zero → skip to next priority

1. Update TodoWrite: mark current priority in_progress

1. Claim issues in Beads:

``bash bd update {issueid} --status inprogress ``

1. Invoke vulnerability-fixer via Task tool:

``` subagent_type: "vulnerability-fixer" description: "Fix {priority} vulnerabilities" prompt: | Read security-scan-report.md and fix all {priority} priority vulnerabilities.

For each vulnerability: 1. Backup file before editing 2. Implement fix 3. Log change to .tmp/current/changes/security-changes.json

Generate/update: security-fixes-implemented.md

Return: count of fixed vulnerabilities, count of failed fixes, list of fixed vuln IDs. ```

1. Quality Gate (inline):

``bash pnpm type-check pnpm build ``

- If FAIL → report error, suggest rollback, exit - If PASS → continue

1. Close fixed issues in Beads:

``bash bd close {issueid1} {issueid2} ... --reason "Security fix applied" ``

1. Update TodoWrite: mark priority complete

1. Repeat for next priority

Phase 6: Verification

After all priorities fixed:

1. Update TodoWrite: mark verification in_progress

1. Invoke security-scanner (verification mode):

``` subagent_type: "security-scanner" description: "Verification scan" prompt: | Re-scan codebase after fixes. Compare with previous security-scan-report.md.

Report: - Vulnerabilities fixed (count) - Vulnerabilities remaining (count) - New vulnerabilities introduced (count) ```

1. Decision:

- If vulnerabilitiesremaining == 0 → Phase 7 - If iteration < 3 AND vulnerabilitiesremaining > 0 → Go to Phase 2 - If iteration >= 3 → Phase 7 with remaining vulnerabilities

Phase 7: Final Summary & Beads Complete

1. Complete Beads wisp:

```bash # If all fixed bd mol squash {wisp_id}

# If nothing found bd mol burn {wisp_id} ```

1. Create issues for remaining vulnerabilities (if any):

``bash bd create "SECURITY REMAINING: {vulntitle}" -t bug -p {priority} \ -d "Not fixed in scan. REQUIRES MANUAL ATTENTION. See security-scan-report.md" bd update {newissue_id} --add-label security ``

1. Generate summary for user:

## Security Health Check Complete

**Wisp ID**: {wisp_id}
**Iterations**: {count}/3
**Status**: {SUCCESS/PARTIAL}

### Results
- Found: {total} vulnerabilities
- Fixed: {fixed} ({percentage}%)
- Remaining: {remaining}

### By Priority
- Critical: {fixed}/{total}
- High: {fixed}/{total}
- Medium: {fixed}/{total}
- Low: {fixed}/{total}

### Beads Issues
- Created: {count}
- Closed: {count}
- Remaining: {count} (SECURITY LABEL - requires attention)

### Validation
- Type Check: {status}
- Build: {status}

### Artifacts
- Detection: `security-scan-report.md`
- Fixes: `security-fixes-implemented.md`

1. Update TodoWrite: mark wisp complete

1. SESSION CLOSE PROTOCOL:

``bash git status git add . bd sync git commit -m "security: {fixed} vulnerabilities fixed ({wisp_id})" bd sync git push ``

Error Handling

If quality gate fails:

Rollback available: .tmp/current/changes/security-changes.json

To rollback:
1. Read changes log
2. Restore files from .tmp/current/backups/
3. Re-run workflow

If worker fails:

• Report error to user
• Keep Beads wisp open for manual completion
• Suggest manual intervention
• Exit workflow

If Beads command fails:

• Log error but continue workflow
• Beads tracking is enhancement, not blocker

Quick Reference