diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index 740e6ff8..56bfd05c 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -54,7 +54,7 @@ { "name": "bitwarden-security-engineer", "source": "./plugins/bitwarden-security-engineer", - "version": "1.3.0", + "version": "1.4.0", "description": "Application security engineering assistant for vulnerability triage, threat modeling, and secure code analysis." }, { diff --git a/README.md b/README.md index caf32113..595e0836 100644 --- a/README.md +++ b/README.md @@ -18,7 +18,7 @@ A curated collection of plugins for AI-assisted development at Bitwarden. Enable | [bitwarden-devops-engineer](plugins/bitwarden-devops-engineer/) | 0.1.5 | DevOps engineering assistant: workflow compliance linting, action security auditing, and org-wide CI/CD remediation | | [bitwarden-init](plugins/bitwarden-init/) | 1.2.2 | Initialize and enhance CLAUDE.md files with Bitwarden's standardized template format | | [bitwarden-product-analyst](plugins/bitwarden-product-analyst/) | 0.1.5 | Product analyst agent for creating comprehensive Bitwarden requirements documents from multiple sources | -| [bitwarden-security-engineer](plugins/bitwarden-security-engineer/) | 1.3.0 | Application security engineering: vulnerability triage, threat modeling, and secure code analysis | +| [bitwarden-security-engineer](plugins/bitwarden-security-engineer/) | 1.4.0 | Application security engineering: vulnerability triage, threat modeling, and secure code analysis | | [bitwarden-software-engineer](plugins/bitwarden-software-engineer/) | 1.0.0 | Software engineer agent for a Bitwarden product team. Implements stories, tasks, and bugs with code quality, performance, security, and team comms in mind. | | [bitwarden-testing-tools](plugins/bitwarden-testing-tools/) | 1.0.0 | Testing tools for analyzing and improving test quality across Bitwarden's repositories. | | [claude-config-validator](plugins/claude-config-validator/) | 1.1.1 | Validates Claude Code configuration files for security, structure, and quality | diff --git a/plugins/bitwarden-security-engineer/.claude-plugin/plugin.json b/plugins/bitwarden-security-engineer/.claude-plugin/plugin.json index 9f31fc9d..518c4445 100644 --- a/plugins/bitwarden-security-engineer/.claude-plugin/plugin.json +++ b/plugins/bitwarden-security-engineer/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "bitwarden-security-engineer", - "version": "1.3.0", + "version": "1.4.0", "description": "Application security engineering assistant for vulnerability triage, threat modeling, and secure code analysis at Bitwarden.", "author": { "name": "Bitwarden", diff --git a/plugins/bitwarden-security-engineer/CHANGELOG.md b/plugins/bitwarden-security-engineer/CHANGELOG.md index 03d20678..d854fdff 100644 --- a/plugins/bitwarden-security-engineer/CHANGELOG.md +++ b/plugins/bitwarden-security-engineer/CHANGELOG.md @@ -5,6 +5,12 @@ All notable changes to the `bitwarden-security-engineer` plugin will be document The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [1.4.0] - 2026-07-28 + +### Changed + +- `bitwarden-security-context`, `reviewing-security-architecture`, and `threat-modeling` now perform the ADR-alignment check by invoking `Skill(bitwarden-planning-tools:consulting-adrs)` instead of reading a local `references/adr-alignment.md`. Removed that reference file; the shared rule now lives in the `consulting-adrs` skill, which returns structured conflict/gap/aligned findings with cited ADRs. Requires the `bitwarden-planning-tools` plugin (1.0.0+). + ## [1.3.0] - 2026-07-21 ### Added diff --git a/plugins/bitwarden-security-engineer/references/adr-alignment.md b/plugins/bitwarden-security-engineer/references/adr-alignment.md deleted file mode 100644 index 2fda84bc..00000000 --- a/plugins/bitwarden-security-engineer/references/adr-alignment.md +++ /dev/null @@ -1,10 +0,0 @@ -# Architecture Decision Alignment - -Bitwarden's accepted architecture decisions are catalogued separately from the security principles in `bitwarden-security-context`. Security assessments must check alignment against these — a design can satisfy P01-P06 in the abstract while still contradicting a specific, already-decided architectural direction. - -- Before assessing a system or change, check whether an existing ADR covers the component or pattern under review. -- A design that conflicts with an accepted ADR is a finding, not a style preference — surface it explicitly rather than silently reviewing against general best practice instead. -- A significant architectural choice with no corresponding ADR is a gap worth flagging, not something to silently wave through. -- Confirm an ADR's status before citing it — superseded or deprecated decisions are historical context, not current constraints. - -Full documentation: [Architecture Decision Records](https://contributing.bitwarden.com/architecture/adr/) diff --git a/plugins/bitwarden-security-engineer/skills/bitwarden-security-context/SKILL.md b/plugins/bitwarden-security-engineer/skills/bitwarden-security-context/SKILL.md index 38cfa704..b7a07dcb 100644 --- a/plugins/bitwarden-security-engineer/skills/bitwarden-security-context/SKILL.md +++ b/plugins/bitwarden-security-engineer/skills/bitwarden-security-context/SKILL.md @@ -63,4 +63,4 @@ Full documentation: [Security Requirements](https://contributing.bitwarden.com/a ## Architecture Decision Records (ADRs) -Bitwarden's accepted architecture decisions are catalogued separately from the security principles above. See `${CLAUDE_PLUGIN_ROOT}/references/adr-alignment.md` for how security assessments should check alignment against them. +Bitwarden's accepted architecture decisions are catalogued separately from the security principles above. To check a design or change against them, invoke `Skill(bitwarden-planning-tools:consulting-adrs)` — it returns structured findings (conflict, gap, stale-reference, aligned) with cited ADRs. diff --git a/plugins/bitwarden-security-engineer/skills/reviewing-security-architecture/SKILL.md b/plugins/bitwarden-security-engineer/skills/reviewing-security-architecture/SKILL.md index a11fee5c..2649fa64 100644 --- a/plugins/bitwarden-security-engineer/skills/reviewing-security-architecture/SKILL.md +++ b/plugins/bitwarden-security-engineer/skills/reviewing-security-architecture/SKILL.md @@ -130,7 +130,7 @@ At each boundary crossing: ## Architecture Decision Alignment -Before evaluating a design, check Bitwarden's Architecture Decision Records for existing decisions relevant to the components under review — see `${CLAUDE_PLUGIN_ROOT}/references/adr-alignment.md` for the ground rules (conflict = finding, undocumented significant decision = gap, verify status before citing). Applied to an architecture review specifically: +Before evaluating a design, check it against Bitwarden's Architecture Decision Records by invoking `Skill(bitwarden-planning-tools:consulting-adrs)` — it returns conflict / gap / stale-reference / aligned findings with cited ADRs. Applied to an architecture review specifically: - **Cite it, don't just flag it.** When a design conflicts with an accepted ADR, name the ADR and state whether the implementation should change or the deviation needs its own ADR justifying the exception. - **Watch for these gap triggers.** New trust boundaries, new auth patterns, new data stores, or other consequential choices with no corresponding ADR are exactly the kind of significant decision that should be flagged so it gets recorded, not just implemented. diff --git a/plugins/bitwarden-security-engineer/skills/threat-modeling/SKILL.md b/plugins/bitwarden-security-engineer/skills/threat-modeling/SKILL.md index 2e2410eb..002cfa28 100644 --- a/plugins/bitwarden-security-engineer/skills/threat-modeling/SKILL.md +++ b/plugins/bitwarden-security-engineer/skills/threat-modeling/SKILL.md @@ -9,7 +9,7 @@ Bitwarden follows a 4-phase engagement model for security work. This skill prima ### Phase 1: Initial Security Assessment (Engineering Team) -1. Check Bitwarden's Architecture Decision Records for existing decisions covering the system or components under review (see `${CLAUDE_PLUGIN_ROOT}/references/adr-alignment.md`) — a threat model should align with already-accepted architecture, not silently re-derive or contradict it +1. Check the system or components under review against Bitwarden's Architecture Decision Records by invoking `Skill(bitwarden-planning-tools:consulting-adrs)` — a threat model should align with already-accepted architecture, not silently re-derive or contradict it 2. Create data flow diagrams (Mermaid) 3. Define security requirements separate from product requirements 4. Propose security definitions (threat model + security goals) @@ -119,7 +119,6 @@ Consult these references when writing or reviewing SDs: - **`references/bitwarden-vocabulary.md`** — Standard terms, including **Passive Observer**, **Dominated Threat**, and **Exposure Window** - **`references/security-principles.md`** — P01–P06, referenced by every goal's Rationale line - **`references/stride-framework.md`** — STRIDE categories for structured threat identification -- **`${CLAUDE_PLUGIN_ROOT}/references/adr-alignment.md`** — Architecture Decision Record alignment checks shared across security-engineer skills ## When to Engage AppSec