Security of a Bitrix project. Orchestrator gates always apply; this sub-skill is deep configuration and auditing. Code goes in /local, do not touch the core.
Task → recipe (../../shared/kb/recipes/security/)
- proactive protection (filter/WAF, web antivirus, levels, OTP) →
security/01-proactive-protection.md - secure development (XSS, CSRF/sessid, SQLi, LFI) →
security/02-secure-coding.md - access rights (groups, rights to information blocks/files/modules) →
security/03-access-rights.md - security audit (what to check, static run) →
security/04-audit.md - known vulnerabilities / CVE / IOC / integrity control after an incident →
security/05-threat-intel.md
Tool
Static check of the project: ../../shared/scripts/check-conventions.sh <каталог_проекта> — catches dangerous constructs (eval(base64), short tags, input handling without check_bitrix_sessid, direct SQL with user input). [FAIL] — blockers, [REVIEW] — check manually.
Knowledge base
Security rules — ../../shared/kb/conventions.md (the "Security" section); the general model — ../../shared/kb/00-overview.md.
Completion
Run check-conventions without [FAIL]; critical [REVIEW] removed manually.