ZespółInżynieria · v1.1.0
Security & AppSec Team
Bezpieczeństwo defensywne — modelowanie zagrożeń, bezpieczny przegląd kodu, ryzyko łańcucha dostaw, reakcja na incydenty i mapowanie SOC 2 / ISO 27001 / NIS2 / DORA.
Threat modelling, secure code review, supply chain risk, incident response and compliance mapping.
Reviews start with object-level authorisation, because that is the defect that shows up most and costs most. Dependency findings are triaged by reachability with the reasoning shown — never raw scanner output.
Defensive only: no exploit code, no attack tooling.
Agenci 5
- 01
compliance-mapperUse to map security controls to frameworks — SOC 2, ISO 27001, NIS2, DORA and customer security questionnaires — producing gap analyses, evidence lists and readiness plans. - 02
dependency-risk-analystUse for supply chain security — dependency and container image auditing, vulnerability triage, licence compliance, SBOM production and reducing exposure to third-party code. - 03
secure-code-reviewerUse to review code for security defects — injection, authorisation gaps, authentication and session flaws, secret handling, cryptography misuse, unsafe deserialisation and insecure defaults. Defensive review only. - 04
security-incident-responderUse during and after suspected security incidents — containment, evidence preservation, scope assessment, remediation and breach notification analysis. Defensive response only. - 05
threat-modelerUse to threat model a system or feature — identifying assets, trust boundaries, attack surface and realistic threats, and specifying the controls that address them. Defensive analysis only.
Skille 2
- 01
appsec-reviewRun a security review of a codebase or change — authorisation, authentication, injection, input handling, secrets, cryptography, configuration and business logic — with severity-ranked findings and fixes. Defensive review only. - 02
threat-modelingThreat model a system or feature — assets, trust boundaries, concrete threat scenarios, existing controls, gaps and a ranked control plan. Defensive analysis only. Use when asked to threat model, assess security design, or review a feature for security risk.
Komendy 2
- 01
/security-reviewSecurity review a codebase, service or pull request and return severity-ranked findings with fixes and verification. - 02
/threat-modelThreat model a system or feature and return ranked threats with a control plan. Defensive analysis only.
Czego ten zespół nie zrobi
No exploit code, proof-of-concept attacks, evasion techniques or unauthorised-access tooling — findings are described precisely enough to fix and to regression-test, and no further. No assessing systems you do not own. No claiming a certification or control the organisation does not have. No writing audit evidence retrospectively. And no pasting raw scanner output as a finding list — every dependency finding is triaged by reachability with the reasoning shown.
- hirre-security-appsec-team/
- .claude-plugin/marketplace manifest
- marketplace.json
- plugins/
- security-appsec-team/
- .claude-plugin/plugin manifest
- plugin.jsonname, version, author
- agents/the specialists
- compliance-mapper.md
- dependency-risk-analyst.md
- secure-code-reviewer.md
- security-incident-responder.md
- threat-modeler.md
- commands/slash commands that run the team
- security-review.md
- threat-model.md
- skills/shared workflows
- appsec-review/
- SKILL.md
- threat-modeling/
- SKILL.md
- HANDBOOK.mdinstall · tune for quality · tune for cost
- README.mdwhat it does, how to use it
- README.mdinstall in two lines
- LICENSE
unzip hirre-security-appsec-team-1.1.0.zip
/plugin marketplace add ./hirre-security-appsec-team
/plugin install security-appsec-team@hirre-security-appsec- v1.3.004 wrz 2026
- Every team now ships a HANDBOOK.md: install, tune for quality, tune for cost.
- v1.0.003 wrz 2026
- Security & AppSec Team joins the catalogue.
→ Współpracownicy
Warto zatrudnić też
Migration & SEO Team
Replatforming, który zachowuje ruch: architektura migracji, inżynierowie Shopify, WordPress/WooCommerce i PrestaShop/Magento, techniczne SEO, mapowanie treści i URL-i, ciągłość analityki i Search Console, SEO międzynarodowe.
Product Engineering Team
Pełny zespół software'owy — architektura, backend, frontend, bazy danych, code review i QA — z workflowami design docu i przeglądu kodu.
DevOps & SRE Team
CI/CD, infrastruktura jako kod, observability i SLO, dowodzenie incydentem i zarządzanie wydaniami, z workflowami runbooków i reakcji na incydenty.