What problem does it solve? Greenfield development on Azure often ships code with inconsistent security controls, missing tests, and unclear architecture boundaries. This Skill provides a single master ruleset that governs every coding decision — from authentication flows to commit hygiene — so AI-generated code meets the same security and quality bar as a senior engineer's work. ## Core Features & Use Cases - Security-First Framework: Enforces three laws (Security First, People First, Agile/Scrum), eight Saltzer-Schroeder security principles, and Zero Trust tenets across all code. - Mandatory TDD Workflow: Requires RED→GREEN→REFACTOR→SCAN→COMMIT with two tests per security control (positive and adversarial) and coverage gates up to 100% for security-critical paths. - Stack-Specific Guidance: Provides concrete patterns for .NET 8 Web APIs (Microsoft.Identity.Web, FluentValidation, rate limiting), React/Blazor (MSAL, DOMPurify, CSP), Cosmos DB and PostgreSQL (Managed Identity, parameterized queries), Databricks (Unity Catalog, PII masking), and Bicep infrastructure with DevSecOps pipeline gates. - Use Case: When starting a new .NET 8 API endpoint, the Skill ensures you write a failing security test first, apply [Authorize] by default, validate input with FluentValidation, prevent BOLA in the service layer, and pass Semgrep scanning before committing. ## Quick Start Ask the AI to scaffold a new authenticated .NET 8 Web API endpoint with Cosmos DB persistence following the security-first-scrum ruleset.
