Add tekimax-security to community catalog by kaman1 · Pull Request #2200 · github/spec-kit

kaman1 · 2026-04-13T09:17:27Z

Adds tekimax-security (TEKIMAX Secure SDD) to the community catalog.

What it does

tekimax-security is a security-first extension that plugs into Spec Kit's hook system and adds security gates to the SDD lifecycle. It catches AI technical debt at the point where it's cheapest to fix — in the spec, before code exists.

Gate	Phase	Catches
Data Contract	SPECIFY	Unvetted sources, unprotected PII, undeclared schemas, hidden bias, drift
Threat Model	DESIGN	STRIDE coverage, unmitigated high/critical threats
Model Governance	DESIGN	Unpinned versions, missing rollback plans, no eval baselines
Guardrails	SPECIFY/IMPLEMENT	Inline prompts, missing input validation, no output redaction
Red Team	VERIFY	Automated adversarial scenarios executed against staging
Inline Content Scan	IMPLEMENT	Committed secrets, direct SDK imports outside the gateway layer

It provides 7 commands and 5 hooks wired into after_specify, after_plan, before_implement, after_implement, and before_analyze. It ships an automated red-team runner that parses scenarios and executes them against a staging endpoint with safety guards (refuses prod URLs, rate-limited, injects an X-Red-Team header), then classifies responses and writes a JSONL trace for audit.

The extension is stack-agnostic — it enforces the existence of security controls (AI gateway, guardrails, PII encryption, RBAC, schema validation) without requiring specific vendors.

Why this fills a gap

Spec Kit excels at turning specifications into code. The existing security-review extension in the catalog is a 3-command, 0-hook post-implementation code audit. tekimax-security is different: it's a lifecycle-wide gate system that enforces security controls at every SDD phase transition via hooks, and includes proactive STRIDE threat modeling, model governance gating, and an automated red-team runner.

Verification

Links

Repository: https://github.com/TEKIMAX/speckit-security
Getting started: https://github.com/TEKIMAX/speckit-security/blob/main/docs/GETTING-STARTED.md
Changelog: https://github.com/TEKIMAX/speckit-security/blob/main/CHANGELOG.md
Release: https://github.com/TEKIMAX/speckit-security/releases/tag/v0.2.0

Compatibility

Requires speckit_version >= 0.1.0. Tested against 0.6.2.

Contact

General: support@tekimax.com
Security disclosures: security@tekimax.com
https://tekimax.com

Happy to iterate on formatting, wording, or the catalog entry structure if anything's off. Thanks for shipping the extension API — it's genuinely a great surface to build on.

Copilot

Pull request overview

Adds the TEKIMAX Secure SDD community extension to Spec Kit’s community catalog so it can be discovered/installed via the standard catalog flow.

Changes:

Adds a new tekimax-security entry to extensions/catalog.community.json with metadata (version, URLs, tags, hook/command counts).
Adds TEKIMAX Secure SDD to the Community Extensions table in the root README.md.

Show a summary per file

File	Description
README.md	Adds a new row advertising the TEKIMAX Secure SDD extension in the community extensions list.
extensions/catalog.community.json	Registers the `tekimax-security` extension (metadata + compatibility requirements) in the community catalog.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 2/2 changed files
Comments generated: 1

Copilot · 2026-04-13T13:38:39Z

extensions/catalog.community.json

+      "stars": 0,
+      "created_at": "2026-04-13T07:00:00Z",
+      "updated_at": "2026-04-13T07:00:00Z"


extensions/EXTENSION-PUBLISHING-GUIDE.md specifies that when updating extensions/catalog.community.json you must bump the file’s top-level updated_at to the current time (and use a current timestamp for the entry’s created_at/updated_at) (see guide around lines 202-205). The catalog header updated_at is still 2026-04-10T17:00:00Z, which is now older than this newly added entry’s updated_at, so consumers relying on the header won’t see the catalog as freshly updated.

Adds an entry for TEKIMAX Secure SDD, a security-first extension that wires threat modeling (STRIDE), data contracts, AI guardrails, model governance, automated red teaming, and post-implementation audit into Spec Kit's hook system. - 7 slash commands across SPECIFY / DESIGN / IMPLEMENT / VERIFY - 5 phase hooks: after_specify, after_plan, before_implement, after_implement, before_analyze - Apache-2.0 licensed - Repository: https://github.com/TEKIMAX/speckit-security

Updates the existing catalog entry to reflect the v0.2.2 release: - version 0.2.0 -> 0.2.2 - download_url repointed at the v0.2.2 archive - provides.commands 7 -> 8 (new install-rules command) - description updated to mention the new install-rules capability which writes to the spec-kit constitution and agent context files - updated_at timestamp refreshed

kaman1 · 2026-04-13T14:06:33Z

Refreshed the catalog entry to reflect the v0.2.2 release:

version 0.2.0 → 0.2.2
download_url repointed at the v0.2.2 archive
provides.commands 7 → 8 (new install-rules command that writes the rules into the spec-kit constitution and agent context file so they bind the AI agent at runtime)
description updated accordingly

Also rebased onto current main to stay in sync. The PR remains a pure single-entry addition to catalog.community.json with no other changes.

Repo: https://github.com/TEKIMAX/speckit-security
Release: https://github.com/TEKIMAX/speckit-security/releases/tag/v0.2.2

Copilot

Pull request overview

Adds the TEKIMAX Secure SDD extension (tekimax-security) to Spec Kit’s community extension listings, making it discoverable via the community catalog and README table.

Changes:

Added a new tekimax-security entry to extensions/catalog.community.json with metadata (version, URLs, tags, provides, requirements).
Added TEKIMAX Secure SDD to the Community Extensions table in README.md.

Show a summary per file

File	Description
README.md	Adds TEKIMAX Secure SDD to the community extensions table for discoverability.
extensions/catalog.community.json	Registers `tekimax-security` in the community catalog with install metadata and capabilities.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 2/2 changed files
Comments generated: 2

Copilot · 2026-04-13T15:01:25Z

extensions/catalog.community.json

+      "verified": false,
+      "downloads": 0,
+      "stars": 0,
+      "created_at": "2026-04-13T07:00:00Z",
+      "updated_at": "2026-04-13T08:30:00Z"


Per the Extension Publishing Guide, new catalog entries should use the current timestamp for both created_at and updated_at, and the catalog’s top-level updated_at should be bumped to the current time when editing the file. This entry uses fixed times and the file’s top-level updated_at (near the top of the JSON) wasn’t updated in this PR.

Copilot · 2026-04-13T15:01:26Z

extensions/catalog.community.json

+      "description": "Adds security gates to the SDD lifecycle — STRIDE threat modeling, data contracts, AI guardrails, model governance, automated red team, and post-implementation audit. Eight commands wired into five Spec Kit hooks. Rules can be installed into the project constitution and agent context files so they bind the AI agent at runtime.",
+      "author": "Christian Kaman (TEKIMAX)",
+      "version": "0.2.2",
+      "download_url": "https://github.com/TEKIMAX/speckit-security/archive/refs/tags/v0.2.2.zip",
+      "repository": "https://github.com/TEKIMAX/speckit-security",


The PR description states the extension ships 7 commands and links to release v0.2.0, but the catalog entry says provides.commands: 8 / “Eight commands …” and sets version/download_url to 0.2.2. Please reconcile these so the PR description and catalog metadata consistently reflect the same release and command count.

mnriem

Please address Copilot feedback. If not applicable, please explain why

kaman1 requested a review from mnriem as a code owner April 13, 2026 09:17

mnriem requested a review from Copilot April 13, 2026 13:35

mnriem self-assigned this Apr 13, 2026

Copilot started reviewing on behalf of mnriem April 13, 2026 13:36 View session

Copilot AI reviewed Apr 13, 2026

View reviewed changes

Christian Kaman added 2 commits April 13, 2026 09:00

kaman1 force-pushed the add-tekimax-security branch from 5d71cfb to e7646be Compare April 13, 2026 14:06

mnriem requested a review from Copilot April 13, 2026 14:58

Copilot started reviewing on behalf of mnriem April 13, 2026 14:59 View session

Copilot AI reviewed Apr 13, 2026

View reviewed changes

mnriem requested changes Apr 13, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add tekimax-security to community catalog#2200

Add tekimax-security to community catalog#2200
kaman1 wants to merge 2 commits intogithub:mainfrom
kaman1:add-tekimax-security

kaman1 commented Apr 13, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 13, 2026

Uh oh!

kaman1 commented Apr 13, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 13, 2026

Uh oh!

Copilot AI Apr 13, 2026

Uh oh!

mnriem left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

kaman1 commented Apr 13, 2026

What it does

Why this fills a gap

Verification

Links

Compatibility

Contact

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

kaman1 commented Apr 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

mnriem left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants