securable-copilot

securable-copilot is a standard GitHub Copilot plugin bundle for FIASSE and OWASP ASVS aligned engineering workflows. It packages reusable Copilot instructions, an agent, commands, skills, and planning templates so teams can apply SSEM guidance directly inside Copilot-driven development.

FIASSE provides the engineering framing. SSEM provides the attribute model. ASVS provides verification-oriented requirement structure.

Plugin Layout

• .github/copilot-instructions.md: repository-wide Copilot instructions for FIASSE and SSEM aligned generation and review
• agents/: user-invocable Copilot agents
• commands/: reusable prompt-style commands for common securability tasks
• skills/: skill packages, shared references, and FIASSE or ASVS source material
• docs/templates/: PRD and ACD templates for planning and requirements work
• plugin.json: root plugin manifest for plugin-aware tooling

Included Capabilities

Agent

• agents/securability-engineer.agent.md: focused securability engineering persona for code generation, review, trust-boundary analysis, and threat modeling support

Commands

• commands/analyze-ssem-attributes.md: evaluate code against the nine SSEM attributes
• commands/evaluate-dependency.md: assess a dependency before adoption
• commands/input-handling.md: implement canonical input handling at a trust boundary
• commands/merge-review.md: run a FIASSE-oriented changeset review
• commands/score-securable-code.md: produce a weighted SSEM assessment for a codebase or component
• commands/security-requirements.md: author security requirements, threat scenarios, and acceptance criteria

Skills and References

• skills/fiasse-lookup/: concept lookup and section guidance
• skills/prd-securability-enhancement/: PRD hardening with ASVS and FIASSE mapping
• skills/securability-code-patterns/: practical implementation patterns
• skills/securability-engineering/: implementation workflow guidance
• skills/securability-engineering-review/: structured review and scoring guidance
• skills/shared-references/: reusable SSEM, trust-boundary, and anti-pattern references
• skills/data/: FIASSE and ASVS reference content used by the skills

Templates

• docs/templates/prd-template.md: product requirements template with security-oriented sections
• docs/templates/acd-template.md: acceptance criteria template aligned to securability expectations

SSEM Attribute Model

The packaged guidance centers on three pillars and nine attributes:

Pillar	Attributes
Maintainability	Analyzability, Modifiability, Testability
Trustworthiness	Confidentiality, Accountability, Authenticity
Reliability	Availability, Integrity, Resilience

These materials also reinforce two recurring implementation principles:

• Canonical input handling at trust boundaries: canonicalize, sanitize, validate
• Derived Integrity Principle: derive business-critical values server-side rather than accepting them from clients

Usage

Use this repository as a plugin package or as source material for an internal Copilot customization bundle. The most direct workflow is:

1. Keep .github/copilot-instructions.md in scope for repository work.
2. Invoke the securability-engineer agent when you want focused FIASSE or SSEM behavior.
3. Use the commands in commands/ for recurring tasks such as reviews, requirement authoring, and scoring.
4. Use the skills in skills/ when you need deeper structured guidance or reference material.

Required Secure Code Generation Sequence

When using the securability-engineer agent for code generation or refactoring, use this order:

1. prd-securability-enhancement skill to enhance the PRD or specification first.
2. securability-engineering skill to generate or refactor implementation code.
3. securability-engineering-review skill to produce a prioritized enhancement plan.
4. score-securable-code command to produce the baseline SSEM score.
5. Prompt the user to confirm whether to run enhancements and a second scoring pass.

If the user proceeds, apply the enhancement plan and re-run score-securable-code, then report score deltas by pillar and overall. If the user declines, return the baseline score and enhancement backlog.

Attribution

Third-party attribution for OWASP FIASSE and OWASP ASVS is documented in THRID_PARTY_NOTICES.md.