Security Settings

Settings for the security enforcement feature (v1.31). All follow the absent = enabled pattern. These keys live under workflow.* in .planning/config.json — matching the shipped template and the runtime reads in workflows/plan-phase.md, workflows/execute-phase.md, workflows/secure-phase.md, and workflows/verify-work.md.

These keys live under workflow.* — that is where the workflows and installer write and read them. Setting them at the top level of config.json is silently ignored.

Setting	Type	Default	Description
workflow.security_enforcement	boolean	true	Enable threat-model-anchored security verification via /gsd-secure-phase. When false, security checks are skipped entirely
workflow.security_asvs_level	number (1-3)	1	OWASP ASVS verification level. Level 1 = opportunistic, Level 2 = standard, Level 3 = comprehensive
workflow.security_block_on	string	"high"	Minimum severity that blocks phase advancement. Options: "high", "medium", "low"