suaveplan/openspec/archive/2026-04-19-enterprise-security-codes/tasks.md

Tasks: enterprise-security-codes

1. Scaffold

• 1.1 universal/auth/security-codes/ skeleton with 100/100/100/100 coverage (istanbul).
• 1.2 Guard tests; CLAUDE.md/README/FOLDERS.yml updated.

2. Errors + schemas

• 2.1 src/errors/security-codes-error.ts — codes SECURITY_CODES.*.
• 2.2 Zod schemas for DetectorOptions, SanitizerOptions, SecurityCodeMatch.

3. Pattern library

• 3.1 src/patterns/aws.ts, jwt.ts, stripe.ts, github.ts, google.ts, openai.ts, credit-card.ts (+ Luhn), pem.ts, ssh.ts, entropy.ts.
• 3.2 Co-located .md per pattern.

4. Detector

• 4.1 src/core/code-detector/code-detector.ts — SecurityCodeDetector; plugin registration; OTel counter + histogram.
• 4.2 Co-located .md; unit tests per pattern; fuzz tests via fast-check.

5. Sanitizer

• 5.1 src/core/code-sanitizer/code-sanitizer.ts — SecurityCodeSanitizer; strategies: full-redact, partial, hash, tokenize.
• 5.2 Idempotency property test.

6. Index / README

• 6.1 Barrel; subpath exports per pattern + core.
• 6.2 Root README.

7. Benchmarks

• 7.1 Detect / sanitize on 10 KB / 1 MB text fixtures.

8. Ship gate

• 8.1 Verification sequence green; fold spec + archive.