Implement comprehensive security hardening with defense-in-depth strategy through coordinated multi-agent orchestration:
[Extended thinking: This workflow implements a defense-in-depth security strategy across all application layers. It coordinates specialized security agents to perform comprehensive assessments, implement layered security controls, and establish continuous security monitoring. The approach follows modern DevSecOps principles with shift-left security, automated scanning, and compliance validation. Each phase builds upon previous findings to create a resilient security posture that addresses both current vulnerabilities and future threats.]
Context: Initial baseline for all remediation efforts
使用Task工具，设置subagent_type="security-auditor"
提示语："对$ARGUMENTS执行全面安全评估。使用Semgrep/SonarQube进行SAST分析，使用OWASP ZAP进行DAST扫描，使用Snyk/Trivy进行依赖项审计，使用GitLeaks/TruffleHog进行密钥检测。生成SBOM用于供应链分析。识别OWASP Top 10漏洞、CWE弱点和CVE暴露。"
输出结果：包含CVSS评分、可利用性分析、攻击面映射、密钥暴露报告、SBOM清单的详细漏洞报告
背景：为所有整改工作提供初始基线
2. Threat Modeling and Risk Analysis
2. 威胁建模与风险分析
Use Task tool with subagent_type="security-auditor"
Prompt: "Conduct threat modeling using STRIDE methodology for: $ARGUMENTS. Analyze attack vectors, create attack trees, assess business impact of identified vulnerabilities. Map threats to MITRE ATT&CK framework. Prioritize risks based on likelihood and impact."
Output: Threat model diagrams, risk matrix with prioritized vulnerabilities, attack scenario documentation, business impact analysis
Context: Uses vulnerability scan results to inform threat priorities
Use Task tool with subagent_type="backend-api-security::backend-security-coder"
Prompt: "Implement comprehensive backend security controls for: $ARGUMENTS. Add input validation with OWASP ESAPI, implement rate limiting and DDoS protection, secure API endpoints with OAuth2/JWT validation, add encryption for data at rest/transit using AES-256/TLS 1.3. Implement secure logging without PII exposure."
Use Task tool with subagent_type="security-auditor"
Prompt: "Implement modern authentication system for: $ARGUMENTS. Deploy OAuth2/OIDC with PKCE, implement MFA with TOTP/WebAuthn/FIDO2, add risk-based authentication, implement RBAC/ABAC with principle of least privilege, add session management with secure token rotation."
Output: Authentication service configuration, MFA implementation, authorization policies, session management system
Context: Strengthens access controls based on architecture review