---
name: review-security
description: Review the SECURITY.md document's contents using a structured 3-tier severity checklist.
argument-hint: "Relative path of the security document to review (default: docs/SECURITY.md)"
---

Read and review the contents of the target SECURITY.md document in the workspace using a structured checklist with three severity levels (問題, 要確認, 提案).

## Review Checklist

### 1. 問題 (Issue/Problem - High Severity)

*Critical errors, logic flaws, or gaps that must be corrected.*

*   **構成要素の不足 (Missing Core Sections)**: Check if required sections are present: "セキュリティポリシー", "認証・認可", "データの保護", "脆弱性対策", and "シークレット管理".
*   **コンセプトとの不整合 (Mismatch with CONCEPT.md)**: Check if the security policy contradicts any architecture or target environment defined in `docs/CONCEPT.md`.
*   **セキュリティ上の致命的な欠陥 (Critical Vulnerabilities/Gaps)**: Missing basic protections like input validation rules, lack of HTTPS mandates, insecure API key handling, or lack of role-based access control.
*   **参照・リンク切れ (Broken Links & References)**: References to non-existent files or directories.

### 2. 要確認 (Needs Confirmation/Clarification - Medium Severity)

*Items that require clarification or validation.*

*   **認証・認可方式の具体性 (Auth Details)**: Ambiguities in JWT expiration, session management, or user permission mapping.
*   **データ保護方針の妥当性 (Data Protection Soundness)**: Unclear specifications for encryption at rest or transit (SSL/TLS versions, hashing algorithms like bcrypt parameters).
*   **シークレット管理の実装方法 (Secret Management Feasibility)**: Verify if secrets are managed via env vars, vaults, or other secure mechanisms, and confirm feasibility with the development environment.

### 3. 提案 (Suggestion/Recommendation - Low Severity)

*Constructive ideas to improve clarity, aesthetics, or user experience.*

*   **脆弱性対策チェックリストの追加 (Vulnerability Checklist)**: Add concrete mapping to OWASP Top 10 or similar security standards.
*   **体裁・構成の改善 (Visual & Formatting Enhancements)**: Use diagram (e.g., authentication flow sequence diagram) to clarify the security architecture.

---

## Execution Flow

1. **Locate Target File**:
   *   If a file path is provided as an argument, use it as the target.
   *   If no argument is provided, default to `docs/SECURITY.md`.
2. **Read Content**:
   *   Read the file content.
3. **Conduct Review**:
   *   Analyze the document line-by-line or section-by-section against the checklist.
4. **Save Report to File**:
   *   Save the formatted review report to `.review/[relative-path-to-target-document]` relative to the project root (e.g., `.review/docs/SECURITY.md`).
   *   Ensure the directories inside `.review/` are created automatically if they do not exist.
   *   If the report file already exists, overwrite it with the new review content.
5. **Output Report**:
   *   Present the structured review report in the chat and notify the user of the path to the saved file.

---

## Output Report Format

Output the review report using the following structure:

```markdown
# Document Review Report: [file basename]

Review of: `[relative/path/to/file]`

## Executive Summary

| Severity | Count | Key Focus |
| --- | --- | --- |
| 🔴 問題 (High) | 0 | Critical issues requiring immediate correction |
| 🟡 要確認 (Medium) | 0 | Items requiring user confirmation or alignment |
| 🟢 提案 (Low) | 0 | Suggestions for readability and quality |

---

## Detailed Findings

### 🔴 問題 (High Severity)
*List critical issues.*

- **[Short Summary of Issue]**
  - **Location**: Line X-Y / Section name
  - **Original Text**: `[original text]`
  - **Description**: [Why it is a problem]
  - **Recommended Action**: [Specific, actionable fix]

### 🟡 要確認 (Medium Severity)
*List items needing confirmation.*

- **[Short Summary]**
  - **Location**: Line X-Y / Section name
  - **Original Text**: `[original text]`
  - **Description**: [What needs confirmation and why]
  - **Recommended Action**: [Specific clarification questions or options]

### 🟢 提案 (Low Severity)
*List suggestions.*

- **[Short Summary]**
  - **Location**: Line X-Y / Section name
  - **Original Text**: `[original text]`
  - **Description**: [How it could be improved]
  - **Recommended Action**: [Concrete suggested text or structure]
```
