EquipoIngeniería · v1.1.0
Security & AppSec Team
Seguridad defensiva — modelado de amenazas, revisión segura de código, riesgo de la cadena de suministro, respuesta a incidentes y mapeo a SOC 2 / ISO 27001 / NIS2 / DORA.
Threat modelling, secure code review, supply chain risk, incident response and compliance mapping.
Reviews start with object-level authorisation, because that is the defect that shows up most and costs most. Dependency findings are triaged by reachability with the reasoning shown — never raw scanner output.
Defensive only: no exploit code, no attack tooling.
Agentes 5
- 01
compliance-mapperUse to map security controls to frameworks — SOC 2, ISO 27001, NIS2, DORA and customer security questionnaires — producing gap analyses, evidence lists and readiness plans. - 02
dependency-risk-analystUse for supply chain security — dependency and container image auditing, vulnerability triage, licence compliance, SBOM production and reducing exposure to third-party code. - 03
secure-code-reviewerUse to review code for security defects — injection, authorisation gaps, authentication and session flaws, secret handling, cryptography misuse, unsafe deserialisation and insecure defaults. Defensive review only. - 04
security-incident-responderUse during and after suspected security incidents — containment, evidence preservation, scope assessment, remediation and breach notification analysis. Defensive response only. - 05
threat-modelerUse to threat model a system or feature — identifying assets, trust boundaries, attack surface and realistic threats, and specifying the controls that address them. Defensive analysis only.
Skills 2
- 01
appsec-reviewRun a security review of a codebase or change — authorisation, authentication, injection, input handling, secrets, cryptography, configuration and business logic — with severity-ranked findings and fixes. Defensive review only. - 02
threat-modelingThreat model a system or feature — assets, trust boundaries, concrete threat scenarios, existing controls, gaps and a ranked control plan. Defensive analysis only. Use when asked to threat model, assess security design, or review a feature for security risk.
Comandos 2
- 01
/security-reviewSecurity review a codebase, service or pull request and return severity-ranked findings with fixes and verification. - 02
/threat-modelThreat model a system or feature and return ranked threats with a control plan. Defensive analysis only.
Lo que este equipo no hará
No exploit code, proof-of-concept attacks, evasion techniques or unauthorised-access tooling — findings are described precisely enough to fix and to regression-test, and no further. No assessing systems you do not own. No claiming a certification or control the organisation does not have. No writing audit evidence retrospectively. And no pasting raw scanner output as a finding list — every dependency finding is triaged by reachability with the reasoning shown.
- hirre-security-appsec-team/
- .claude-plugin/marketplace manifest
- marketplace.json
- plugins/
- security-appsec-team/
- .claude-plugin/plugin manifest
- plugin.jsonname, version, author
- agents/the specialists
- compliance-mapper.md
- dependency-risk-analyst.md
- secure-code-reviewer.md
- security-incident-responder.md
- threat-modeler.md
- commands/slash commands that run the team
- security-review.md
- threat-model.md
- skills/shared workflows
- appsec-review/
- SKILL.md
- threat-modeling/
- SKILL.md
- HANDBOOK.mdinstall · tune for quality · tune for cost
- README.mdwhat it does, how to use it
- README.mdinstall in two lines
- LICENSE
unzip hirre-security-appsec-team-1.1.0.zip
/plugin marketplace add ./hirre-security-appsec-team
/plugin install security-appsec-team@hirre-security-appsec- v1.3.004 sept 2026
- Every team now ships a HANDBOOK.md: install, tune for quality, tune for cost.
- v1.0.003 sept 2026
- Security & AppSec Team joins the catalogue.
→ Compañeros
También merece la pena contratar
Migration & SEO Team
Replatforming que conserva el tráfico: arquitectura de migración, ingenieros de Shopify, WordPress/WooCommerce y PrestaShop/Magento, SEO técnico, mapeo de contenidos y URLs, continuidad de analítica y Search Console, y SEO internacional.
Product Engineering Team
Un equipo de software completo — arquitectura, backend, frontend, base de datos, revisión de código y QA — con workflows de documento de diseño y code review.
DevOps & SRE Team
CI/CD, infraestructura como código, observabilidad y SLOs, mando de incidentes y gestión de releases, con workflows de runbooks y respuesta a incidentes.