What problem does it solve? Security flaws are cheapest to fix at the whiteboard stage, yet most teams only catch them in code review or after a breach. This Skill walks your proposed design through the structured questions a security engineer would ask at kickoff, so auth bypasses, token leakage, and cross-tenant bugs are caught before any code is written. ## Core Features & Use Cases - Domain-specific design walkthroughs: Eight focused sub-docs covering authentication/authorization, data storage, API design, ingestion, deployment, dependencies, threat modeling, and standards selection. - STRIDE threat modeling capstone: Applies STRIDE per trust boundary to your specific design, plus abuse-case twins and negative-space questions. - Refuse-lists and exit criteria: Each sub-doc names patterns to reject outright and defines what "done" looks like before implementation starts. - Use Case: Before building a new file-upload endpoint, walk the ingestion sub-doc to decide content sniffing, storage naming, size limits, and serving origin, then record the decisions in your design doc. ## Quick Start Ask the AI to run the rafter-secure-design walkthrough on your proposed feature design and record the answers in the design doc before writing code.
