Prompt file imported from sohamda/model-upgrade-automation (.github/prompts/security-plan-from-prd.prompt.md). Fill in {{project_slug}} before use. Copyright stays with the author.

Security Plan from PRD/BRD

Name: security-plan-from-prd
Author: sohamda

Startup

Display the Security Planning CAUTION block from #file:../../instructions/shared/disclaimer-language.instructions.md verbatim at the start of every new conversation and whenever disclaimerShownAt is null in state.json, before any questions or analysis. After displaying the disclaimer, set disclaimerShownAt to the current ISO 8601 timestamp in state.json.

After the disclaimer, display the framework attribution OWASP ASVS • OWASP Top 10 • NIST SSDF. Display both the disclaimer and the attribution before any questions or analysis.

Activate the Security Planner in from-prd mode to bootstrap a security plan from existing product definition artifacts.

Inputs

{{project_slug}}: (Optional) Project slug for the security plan directory. When omitted, derive from the discovered PRD/BRD project name.

Requirements

PRD/BRD Discovery

Scan these directories as the primary discovery path:

.copilot-tracking/prd-sessions/ for product requirements documents
.copilot-tracking/brd-sessions/ for business requirements documents

If the primary paths yield no matches, perform a secondary scan of .copilot-tracking/ for files whose names match prd-*.md, *-prd.md, brd-*.md, *-brd.md, or product-definition*.md. Exclude generic matches like requirements.txt or files outside product-scoping contexts.

Present all discovery results to the user for confirmation before proceeding. Example results:

Found 3 candidates:
  ✅ .copilot-tracking/prd-sessions/contoso-api/prd-final.md
  ✅ .copilot-tracking/brd-sessions/contoso-api/brd-v2.md
  ❌ .copilot-tracking/plans/npm-requirements.md (false positive, discard)

If zero artifacts are found after both scans: inform the user that no PRD/BRD artifacts were discovered, offer to switch to capture mode using the /security-capture prompt, or ask the user to provide a file path manually. Do not proceed to scope extraction without at least one confirmed artifact.

Scope Extraction

From confirmed artifacts, extract:

Project name and description
Technology stack and frameworks
Deployment targets (cloud provider, regions, environments)
Data classification and sensitivity levels
Compliance requirements mentioned in the artifacts
Stakeholder roles identified

If the project name cannot be derived from the discovered artifacts and {{project_slug}} is empty, prompt the user for a project slug before proceeding to state initialization.

State Initialization

Create the project directory at .copilot-tracking/security-plans/{project-slug}/ and initialize state.json with:

entryMode set to "from-prd"
currentPhase set to 1
Pre-populated fields from extracted PRD/BRD data (project slug, technology inventory, deployment targets, compliance requirements)

Phase 1 Entry

Present the extracted scope to the user as a checklist using ❓ (pending) and ✅ (confirmed) markers. Ask 3-5 clarifying questions targeting:

Gaps in the extracted information
Security-specific concerns not covered in the PRD/BRD
Data handling and privacy requirements
Integration points and external dependencies

# Security Plan from PRD/BRD ## Startup Display the Security Planning CAUTION block from #file:../../instructions/shared/disclaimer-language.instructions.md verbatim at the start of every new conversation and whenever `disclaimerShownAt` is `null` in `state.json`, before any questions or analysis. After displaying the disclaimer, set `disclaimerShownAt` to the current ISO 8601 timestamp in `state.json`. After the disclaimer, display the framework attribution `OWASP ASVS • OWASP Top 10 • NIST SSDF`. Display both the disclaimer and the attribution before any questions or analysis. Activate the Security Planner in **from-prd mode** to bootstrap a security plan from existing product definition artifacts. ## Inputs * {{project_slug}}: (Optional) Project slug for the security plan directory. When omitted, derive from the discovered PRD/BRD project name. ## Requirements ### PRD/BRD Discovery Scan these directories as the primary discovery path: * `.copilot-tracking/prd-sessions/` for product requirements documents * `.copilot-tracking/brd-sessions/` for business requirements documents If the primary paths yield no matches, perform a secondary scan of `.copilot-tracking/` for files whose names match `prd-*.md`, `*-prd.md`, `brd-*.md`, `*-brd.md`, or `product-definition*.md`. Exclude generic matches like `requirements.txt` or files outside product-scoping contexts. Present all discovery results to the user for confirmation before proceeding. Example results: ```text Found 3 candidates: ✅ .copilot-tracking/prd-sessions/contoso-api/prd-final.md ✅ .copilot-tracking/brd-sessions/contoso-api/brd-v2.md ❌ .copilot-tracking/plans/npm-requirements.md (false positive, discard) ``` If zero artifacts are found after both scans: inform the user that no PRD/BRD artifacts were discovered, offer to switch to capture mode using the `/security-capture` prompt, or ask the user to provide a file path manually. Do not proceed to scope extraction without at least one confirmed artifact. ### Scope Extraction From confirmed artifacts, extract: * Project name and description * Technology stack and frameworks * Deployment targets (cloud provider, regions, environments) * Data classification and sensitivity levels * Compliance requirements mentioned in the artifacts * Stakeholder roles identified If the project name cannot be derived from the discovered artifacts and `{{project_slug}}` is empty, prompt the user for a project slug before proceeding to state initialization. ### State Initialization Create the project directory at `.copilot-tracking/security-plans/{project-slug}/` and initialize `state.json` with: * `entryMode` set to `"from-prd"` * `currentPhase` set to `1` * Pre-populated fields from extracted PRD/BRD data (project slug, technology inventory, deployment targets, compliance requirements) ### Phase 1 Entry Present the extracted scope to the user as a checklist using ❓ (pending) and ✅ (confirmed) markers. Ask 3-5 clarifying questions targeting: * Gaps in the extracted information * Security-specific concerns not covered in the PRD/BRD * Data handling and privacy requirements * Integration points and external dependencies

{ "prompt": "# Security Plan from PRD/BRD\n\n## Startup\n\nDisplay the Security Planning CAUTION block from #file:../../instructions/shared/disclaimer-language.instructions.md verbatim at the start of every new conversation and whenever `disclaimerShownAt` is `null` in `state.json`, before any questions or analysis. After displaying the disclaimer, set `disclaimerShownAt` to the current ISO 8601 timestamp in `state.json`.\n\nAfter the disclaimer, display the framework attribution `OWASP ASVS • OWASP Top 10 • NIST SSDF`. Display both the disclaimer and the attribution before any questions or analysis.\n\nActivate the Security Planner in **from-prd mode** to bootstrap a security plan from existing product definition artifacts.\n\n## Inputs\n\n* {{project_slug}}: (Optional) Project slug for the security plan directory. When omitted, derive from the discovered PRD/BRD project name.\n\n## Requirements\n\n### PRD/BRD Discovery\n\nScan these directories as the primary discovery path:\n\n* `.copilot-tracking/prd-sessions/` for product requirements documents\n* `.copilot-tracking/brd-sessions/` for business requirements documents\n\nIf the primary paths yield no matches, perform a secondary scan of `.copilot-tracking/` for files whose names match `prd-*.md`, `*-prd.md`, `brd-*.md`, `*-brd.md`, or `product-definition*.md`. Exclude generic matches like `requirements.txt` or files outside product-scoping contexts.\n\nPresent all discovery results to the user for confirmation before proceeding. Example results:\n\n```text\nFound 3 candidates:\n ✅ .copilot-tracking/prd-sessions/contoso-api/prd-final.md\n ✅ .copilot-tracking/brd-sessions/contoso-api/brd-v2.md\n ❌ .copilot-tracking/plans/npm-requirements.md (false positive, discard)\n```\n\nIf zero artifacts are found after both scans: inform the user that no PRD/BRD artifacts were discovered, offer to switch to capture mode using the `/security-capture` prompt, or ask the user to provide a file path manually. Do not proceed to scope extraction without at least one confirmed artifact.\n\n### Scope Extraction\n\nFrom confirmed artifacts, extract:\n\n* Project name and description\n* Technology stack and frameworks\n* Deployment targets (cloud provider, regions, environments)\n* Data classification and sensitivity levels\n* Compliance requirements mentioned in the artifacts\n* Stakeholder roles identified\n\nIf the project name cannot be derived from the discovered artifacts and `{{project_slug}}` is empty, prompt the user for a project slug before proceeding to state initialization.\n\n### State Initialization\n\nCreate the project directory at `.copilot-tracking/security-plans/{project-slug}/` and initialize `state.json` with:\n\n* `entryMode` set to `\"from-prd\"`\n* `currentPhase` set to `1`\n* Pre-populated fields from extracted PRD/BRD data (project slug, technology inventory, deployment targets, compliance requirements)\n\n### Phase 1 Entry\n\nPresent the extracted scope to the user as a checklist using ❓ (pending) and ✅ (confirmed) markers. Ask 3-5 clarifying questions targeting:\n\n* Gaps in the extracted information\n* Security-specific concerns not covered in the PRD/BRD\n* Data handling and privacy requirements\n* Integration points and external dependencies", "variables": [ "project_slug" ], "notes": "Start security planning from PRD/BRD artifacts using the Security Planner agent (from-prd mode)", "metadata": { "source": { "provider": "github-prompts", "repository": "https://github.com/sohamda/model-upgrade-automation", "path": ".github/prompts/security-plan-from-prd.prompt.md", "ref": "34ff2551a0948d1560af76a2d2b0581d247799d2", "url": "https://github.com/sohamda/model-upgrade-automation/blob/34ff2551a0948d1560af76a2d2b0581d247799d2/.github/prompts/security-plan-from-prd.prompt.md", "key": "sohamda/model-upgrade-automation/.github/prompts/security-plan-from-prd.prompt.md" } } }

security-plan-from-prd

About

Security Plan from PRD/BRD

Startup

Inputs

Requirements

PRD/BRD Discovery

Scope Extraction

State Initialization

Phase 1 Entry

Use it

Manifest

Reviews