Skip to main content

Secure Spec Overview

Secure Spec triggered inside an agent's planning step. Tailored guidance returned to the agent based on which rules apply. Secure Spec running against a revised plan.

Secure Spec reviews coding-agent plans against your organisation's security rules before implementation begins.

When a plan is ready, the agent asks whether you want it reviewed. Secure Spec then returns guidance for the rules that apply to the proposed work.

Secure Spec works with Claude Code, Cursor, and GitHub Copilot CLI.

Benefits​

Key behaviours customers benefit from:

  • Hook-triggered review — Secure Spec uses editor hooks to detect plans and prompt the agent to request a security review. The agent receives the resulting guidance through the review tool.
  • Scoped to what's changing — rules apply only to the projects and files the plan actually touches, so agents aren't distracted by irrelevant policies.
  • Resilient by design — if Secure Spec can't reach a rule or a check fails, the plan still proceeds; security guidance augments the agent rather than blocking it.
  • Always up-to-date — evaluations run against the exact commit the agent is planning from, so guidance matches the real state of your codebase.

Monitor Secure Spec​

The Secure Spec dashboard shows how many plans were evaluated, how broadly Secure Spec is being used across your repositories, and which rules are providing the most guidance. Use the time-range selector to review recent activity.

What to expect​

  1. Your coding agent creates or updates a plan.
  2. The agent asks whether the plan is Ready for review or Still drafting.
  3. When you mark it ready, Secure Spec reviews it against the relevant rules.
  4. The agent receives any required changes or recommendations before it starts implementation.

If you choose Still drafting, the review waits until you say the plan is ready.

Block and Warn rules​

Each rule used in Secure Spec has a plan-time enforcement setting:

  • Block instructs the agent to resolve blocking findings before implementation. The agent should make targeted plan changes or explain supporting evidence when disputing a finding, and seek resolution for any disputed blocker.
  • Warn recommends a change but allows implementation to continue.

In a review with both modes, only Block findings prevent implementation. Warn findings remain optional recommendations. The agent should briefly report the changes made, unresolved blockers, and whether implementation may proceed; it should not silently dismiss a blocking finding.

Block is currently enforced through instructions to the coding agent. The CLI tracks whether the review was delivered; it does not verify that the plan was corrected or require a passing re-review. Delivery alone is not evidence that a blocker has been resolved.

You can configure this setting when adding or editing a team rule.

Relevant guidance only​

Secure Spec considers Live rules that:

  • Are enabled for Secure Spec.
  • Apply to the repositories and projects affected by the plan.
  • Are relevant to the proposed changes.

For example, a plan that changes authentication code can receive authentication guidance, while a database change can receive injection-prevention guidance. Rules unrelated to the planned work are not shown to the agent.