bitwarden · SaintPatrck · Jul 28, 2026 · Aug 5, 2026 · claude · Aug 5, 2026
@@ -54,7 +54,7 @@
     {
       "name": "bitwarden-security-engineer",
       "source": "./plugins/bitwarden-security-engineer",
-      "version": "1.3.0",
+      "version": "1.4.0",
       "description": "Application security engineering assistant for vulnerability triage, threat modeling, and secure code analysis."
     },
     {

@@ -18,7 +18,7 @@ A curated collection of plugins for AI-assisted development at Bitwarden. Enable
 | [bitwarden-devops-engineer](plugins/bitwarden-devops-engineer/)     | 0.1.5   | DevOps engineering assistant: workflow compliance linting, action security auditing, and org-wide CI/CD remediation                                         |
 | [bitwarden-init](plugins/bitwarden-init/)                           | 1.2.2   | Initialize and enhance CLAUDE.md files with Bitwarden's standardized template format                                                                        |
 | [bitwarden-product-analyst](plugins/bitwarden-product-analyst/)     | 0.1.5   | Product analyst agent for creating comprehensive Bitwarden requirements documents from multiple sources                                                     |
-| [bitwarden-security-engineer](plugins/bitwarden-security-engineer/) | 1.3.0   | Application security engineering: vulnerability triage, threat modeling, and secure code analysis                                                           |
+| [bitwarden-security-engineer](plugins/bitwarden-security-engineer/) | 1.4.0   | Application security engineering: vulnerability triage, threat modeling, and secure code analysis                                                           |
 | [bitwarden-software-engineer](plugins/bitwarden-software-engineer/) | 1.0.0   | Software engineer agent for a Bitwarden product team. Implements stories, tasks, and bugs with code quality, performance, security, and team comms in mind. |
 | [bitwarden-testing-tools](plugins/bitwarden-testing-tools/)         | 1.0.0   | Testing tools for analyzing and improving test quality across Bitwarden's repositories.                                                                     |
 | [claude-config-validator](plugins/claude-config-validator/)         | 1.1.1   | Validates Claude Code configuration files for security, structure, and quality                                                                              |

@@ -1,6 +1,6 @@
 {
   "name": "bitwarden-security-engineer",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Application security engineering assistant for vulnerability triage, threat modeling, and secure code analysis at Bitwarden.",
   "author": {
     "name": "Bitwarden",

@@ -5,6 +5,12 @@ All notable changes to the `bitwarden-security-engineer` plugin will be document
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.4.0] - 2026-07-28
+
+### Changed
+
+- `bitwarden-security-context`, `reviewing-security-architecture`, and `threat-modeling` now perform the ADR-alignment check by invoking `Skill(bitwarden-planning-tools:consulting-adrs)` instead of reading a local `references/adr-alignment.md`. Removed that reference file; the shared rule now lives in the `consulting-adrs` skill, which returns structured conflict/gap/aligned findings with cited ADRs. Requires the `bitwarden-planning-tools` plugin (1.0.0+).
- `bitwarden-security-context`, `reviewing-security-architecture`, and `threat-modeling` now perform the ADR-alignment check by invoking `Skill(bitwarden-planning-tools:consulting-adrs)` instead of reading a local `references/adr-alignment.md`. Removed that reference file; the shared rule now lives in the `consulting-adrs` skill, which returns structured conflict/gap/aligned findings with cited ADRs. Requires the `bitwarden-planning-tools` plugin (1.0.0+).
+- `bitwarden-security-context`, `reviewing-security-architecture`, and `threat-modeling` now perform the ADR-alignment check by invoking `Skill(bitwarden-planning-tools:consulting-adrs)` instead of reading a local `references/adr-alignment.md`. Removed that reference file; the shared rule now lives in the `consulting-adrs` skill, which returns structured conflict/gap/stale-reference/aligned findings with cited ADRs. Requires the `bitwarden-planning-tools` plugin (1.0.0+).
- `bitwarden-security-context`, `reviewing-security-architecture`, and `threat-modeling` now perform the ADR-alignment check by invoking `Skill(bitwarden-planning-tools:consulting-adrs)` instead of reading a local `references/adr-alignment.md`. Removed that reference file; the shared rule now lives in the `consulting-adrs` skill, which returns structured conflict/gap/aligned findings with cited ADRs. Requires the `bitwarden-planning-tools` plugin (1.0.0+).
+- `bitwarden-security-context`, `reviewing-security-architecture`, and `threat-modeling` now perform the ADR-alignment check by invoking `Skill(bitwarden-planning-tools:consulting-adrs)` instead of reading a local `references/adr-alignment.md`. Removed that reference file; the shared rule now lives in the `consulting-adrs` skill, which returns structured conflict/gap/stale-reference/aligned findings with cited ADRs. Requires the `bitwarden-planning-tools` plugin (1.0.0+).
+
 ## [1.3.0] - 2026-07-21
 
 ### Added

@@ -63,4 +63,4 @@ Full documentation: [Security Requirements](https://contributing.bitwarden.com/a
 
 ## Architecture Decision Records (ADRs)
 
-Bitwarden's accepted architecture decisions are catalogued separately from the security principles above. See `${CLAUDE_PLUGIN_ROOT}/references/adr-alignment.md` for how security assessments should check alignment against them.
+Bitwarden's accepted architecture decisions are catalogued separately from the security principles above. To check a design or change against them, invoke `Skill(bitwarden-planning-tools:consulting-adrs)` — it returns structured findings (conflict, gap, stale-reference, aligned) with cited ADRs.
@@ -130,7 +130,7 @@ At each boundary crossing:
 
 ## Architecture Decision Alignment
 
-Before evaluating a design, check Bitwarden's Architecture Decision Records for existing decisions relevant to the components under review — see `${CLAUDE_PLUGIN_ROOT}/references/adr-alignment.md` for the ground rules (conflict = finding, undocumented significant decision = gap, verify status before citing). Applied to an architecture review specifically:
+Before evaluating a design, check it against Bitwarden's Architecture Decision Records by invoking `Skill(bitwarden-planning-tools:consulting-adrs)` — it returns conflict / gap / stale-reference / aligned findings with cited ADRs. Applied to an architecture review specifically:
 
 - **Cite it, don't just flag it.** When a design conflicts with an accepted ADR, name the ADR and state whether the implementation should change or the deviation needs its own ADR justifying the exception.
 - **Watch for these gap triggers.** New trust boundaries, new auth patterns, new data stores, or other consequential choices with no corresponding ADR are exactly the kind of significant decision that should be flagged so it gets recorded, not just implemented.

@@ -9,7 +9,7 @@ Bitwarden follows a 4-phase engagement model for security work. This skill prima
 
 ### Phase 1: Initial Security Assessment (Engineering Team)
 
-1. Check Bitwarden's Architecture Decision Records for existing decisions covering the system or components under review (see `${CLAUDE_PLUGIN_ROOT}/references/adr-alignment.md`) — a threat model should align with already-accepted architecture, not silently re-derive or contradict it
+1. Check the system or components under review against Bitwarden's Architecture Decision Records by invoking `Skill(bitwarden-planning-tools:consulting-adrs)` — a threat model should align with already-accepted architecture, not silently re-derive or contradict it
 2. Create data flow diagrams (Mermaid)
 3. Define security requirements separate from product requirements
 4. Propose security definitions (threat model + security goals)
@@ -119,7 +119,6 @@ Consult these references when writing or reviewing SDs:
 - **`references/bitwarden-vocabulary.md`** — Standard terms, including **Passive Observer**, **Dominated Threat**, and **Exposure Window**
 - **`references/security-principles.md`** — P01–P06, referenced by every goal's Rationale line
 - **`references/stride-framework.md`** — STRIDE categories for structured threat identification
-- **`${CLAUDE_PLUGIN_ROOT}/references/adr-alignment.md`** — Architecture Decision Record alignment checks shared across security-engineer skills
 
 ## When to Engage AppSec
Original file line number	Diff line number	Diff line change
Expand Up		@@ -63,4 +63,4 @@ Full documentation: [Security Requirements](https://contributing.bitwarden.com/a

		## Architecture Decision Records (ADRs)

		Bitwarden's accepted architecture decisions are catalogued separately from the security principles above. See `${CLAUDE_PLUGIN_ROOT}/references/adr-alignment.md` for how security assessments should check alignment against them.
		Bitwarden's accepted architecture decisions are catalogued separately from the security principles above. To check a design or change against them, invoke `Skill(bitwarden-planning-tools:consulting-adrs)` — it returns structured findings (conflict, gap, stale-reference, aligned) with cited ADRs.