{"id":51693227,"url":"https://github.com/hindermath/spec-kit-preset-security-governance","last_synced_at":"2026-07-16T03:30:43.094Z","repository":{"id":364037390,"uuid":"1221903584","full_name":"hindermath/spec-kit-preset-security-governance","owner":"hindermath","description":null,"archived":false,"fork":false,"pushed_at":"2026-06-11T10:31:11.000Z","size":35,"stargazers_count":1,"open_issues_count":1,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-06-11T12:14:45.372Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/hindermath.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-04-26T20:33:14.000Z","updated_at":"2026-06-11T10:31:15.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/hindermath/spec-kit-preset-security-governance","commit_stats":null,"previous_names":["hindermath/spec-kit-preset-security-governance"],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/hindermath/spec-kit-preset-security-governance","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hindermath%2Fspec-kit-preset-security-governance","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hindermath%2Fspec-kit-preset-security-governance/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hindermath%2Fspec-kit-preset-security-governance/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hindermath%2Fspec-kit-preset-security-governance/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/hindermath","download_url":"https://codeload.github.com/hindermath/spec-kit-preset-security-governance/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hindermath%2Fspec-kit-preset-security-governance/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35529568,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-16T02:00:06.687Z","response_time":83,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-07-16T03:30:42.465Z","updated_at":"2026-07-16T03:30:43.089Z","avatar_url":"https://github.com/hindermath.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Security Governance Preset\n\nVersion: `0.6.0`\nRequires: `spec-kit \u003e= 0.8.0` (uses the `wrap` and `append` composition\nstrategies introduced in 0.8.x).\n\nPurpose:\n\n- inject secure-development governance into Spec Kit workflows\n- cover code-level controls, language-specific secure-coding profiles, SDLC\n  controls, SBOM/AI-SBOM supply-chain transparency, CRA awareness, and\n  regulatory applicability screening for NIS2, CRA, EU AI Act, and DORA\n- stay focused on code and process; architectural depth lives in the\n  `architecture-governance` preset\n\nPrimary source chapters from `home-baseline` constitution:\n\n- `XI. Memory-Safe Languages (MSL) Preference for Level-2 Projects`\n- `XII. Secure Code Generation`\n- security-related applicability rules from `XIV`\n- `XV. Secure SDLC \u0026 Verification Standards`\n- `XVI. Supply-Chain Transparency \u0026 Build Integrity`\n- `XIX. EU Cyber Resilience Act (CRA) \u0026 Regulatory Applicability Awareness`\n\nStandards in scope:\n\n- `MSL preference`\n- `NIST SSDF` (SP 800-218)\n- `CWE Top 25`\n- `OWASP ASVS` with explicit Level 1/2/3 selection\n- `SBOM` and `VEX`\n- `AI-SBOM` / G7 SBOM for AI minimum elements\n- `SLSA`\n- `OpenSSF Scorecard`\n- `EU CRA` (Regulation (EU) 2024/2847)\n- `NIS2`, `EU AI Act`, and `DORA` as applicability screening topics\n\nPreset strategy:\n\n- append governance sections to `constitution-template`, `spec-template`,\n  `plan-template`, and `tasks-template`\n- provide a standalone agent-guidance addendum template for projects that\n  maintain agent instruction files\n- wrap `speckit.specify`, `speckit.plan`, and `speckit.tasks` with a small\n  shared security workflow\n- provide concrete evidence templates for secure-development artefacts,\n  including CRA/regulatory applicability records and language-specific\n  secure-coding rules\n\nEvidence templates included:\n\n- `standard-applicability-template` (audit-ready standards applicability matrix)\n- Spec-Kit run evidence fields are embedded in the evidence templates to support audit-ready applicability, N/A rationale, reviewer, and follow-up records.\n- `msl-applicability-template`\n- `secure-coding-language-rules-template` (C, C#/.NET, Rust, Go, Swift,\n  Java/Kotlin, Python, TypeScript/JavaScript, SQL, Bash, PowerShell,\n  cryptography, error handling)\n- `security-checklist-template` (with `CWE Top 25` mapping table)\n- `dependency-audit-template` (with Renovatebot/Dependabot/Dependency\n  Track automation posture)\n- `asvs-verification-template` (with explicit Level 1/2/3 rationale)\n- `supply-chain-evidence-template` (SBOM, AI-SBOM, VEX, SLSA, OpenSSF Scorecard)\n- `cra-applicability-template`\n- `regulatory-applicability-template` (NIS2, CRA, EU AI Act, DORA\n  Applicable/N/A/Open matrix)\n\nDefault evidence location: `docs/security/`. MSL justification may live in\nthe feature spec, local constitution, or another governance document, but\nshould be referenced from planning artefacts.\n\nWhen to use:\n\n- teams that want explicit secure-development prompts in specs, plans, and\n  tasks\n- projects with web, API, release, or dependency risk\n- projects that may fall under the EU Cyber Resilience Act\n- projects that need a lightweight NIS2, CRA, EU AI Act, or DORA\n  applicability screen without treating those regimes as automatically\n  binding\n- organisations that need reusable secure-development evidence stubs\n- projects that use AI runtime or product components and need internal\n  transparency for models, datasets, inference infrastructure, and security\n  properties\n\nAI-SBOM applicability:\n\n- AI used only as development tooling (code generation, documentation, review,\n  local agents) is documented as `N/A` with a short toolchain rationale.\n- AI models, AI services, training or embedding datasets, inference\n  infrastructure, or AI runtime components in the released or operated system\n  trigger AI-SBOM evidence.\n- The G7/BSI AI-SBOM minimum elements are treated as target architecture, not\n  as a direct legal obligation by themselves.\n\nRegulatory applicability:\n\n- NIS2, CRA, EU AI Act, DORA, sector-specific rules, and customer/supply-chain\n  obligations are screened through `regulatory-applicability-template`.\n- Private training, learning, and reference projects default to `N/A` when no\n  regulated service, regulated customer, EU-market product, AI runtime/product\n  component, financial-sector ICT dependency, or regulated supply-chain role\n  exists.\n- CRA-scoped projects still use `cra-applicability-template` for the deeper\n  conformity and vulnerability-handling record.\n\nWhen not to use:\n\n- projects that want only architecture governance without SDLC-level\n  security (use `architecture-governance` instead or in combination)\n- teams not ready to maintain security evidence artefacts at all\n\nMSL notes:\n\n- this preset includes the `XI. Memory-Safe Languages` policy surface\n- `Best practices of MSL languages` are treated as the combination of `XI`\n  and `XII`: `XI` governs language choice; `XII` governs how the chosen\n  language is used\n- `v0.4.0` expanded the language-specific secure-coding template so that MSL\n  projects still review concrete framework/API usage for Rust, Go, Swift,\n  Java/Kotlin, Python, and TypeScript/JavaScript instead of treating the\n  language choice as sufficient\n- `v0.5.0` adds the lightweight regulatory applicability screen for NIS2,\n  CRA, EU AI Act, and DORA\n- the addendum surfaces a non-blocking advisory pattern; a runtime warning\n  in the Spec Kit CLI itself is tracked separately\n\nRelease notes:\n\n- `v0.6.0` adds audit-ready Spec-Kit run evidence fields so generated Markdown documents and checklists can record applicability, N/A rationale, reviewer, evidence path, residual risk, and follow-up per standards-relevant Spec-Kit run.\n\nRecommended standalone install priority:\n\n- `10`\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhindermath%2Fspec-kit-preset-security-governance","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhindermath%2Fspec-kit-preset-security-governance","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhindermath%2Fspec-kit-preset-security-governance/lists"}