# Introducing Secure Spec: Security Starts with the Plan > Source: > Published: 2026-09-11 00:00:00+00:00 # Introducing Secure Spec: Security Starts with the Plan Coding agents have given birth to a new age of software development. Software engineers now have a force multiplier, and citizen developers have the gift of creation through plain English. At Dam Secure, we’re invested in helping you secure the software empire you’re building by preventing and detecting vulnerabilities. We’ve tasked ourselves with answering a simple question: how can we prevent vulnerabilities before the code is ever written? We started our exploration by breaking down the typical AI-enabled development workflow to identify opportunities to inject security guidance. We began by focusing on planning and design. It feels like an intuitive place to introduce security context because no code has been written yet. The agent loop makes this particularly interesting: security teams can review a proposed design, give feedback, and have the agent revise it before implementation. Agentic development makes it possible to do this at scale. ## The plan is the contract When building complex features, many developers using coding agents use some form of planning or spec-driven development. They ask an agent to explore the codebase and propose a plan, review and refine it, and then give the agent the go-ahead to implement. Whether developers use native plan mode, custom planning skills, or open-source tools like Superpowers, the result is a plan: a contract for what the agent is about to build. Before the agent starts writing code, we can review that contract against the repository’s security rules and posture and give it specific feedback on what needs to change. Secure Spec brings that review into the developer’s workflow. Our CLI captures implementation plans and routes them through a security review. When a plan violates a configured rule, the agent receives feedback to revise it before proceeding with implementation. ## What does that change? Consider an agent planning a new feature that lets users download documents from their organization’s workspace. The plan covers the endpoint, the database query, and the download button. But it leaves out a critical requirement: checking that the requested document belongs to the authenticated user’s organization. If the repository has a security rule requiring organization-scoped access checks, that omission is something the review can flag while the feature is still a blueprint. The feedback gives the agent a concrete change to make: include an organization ownership check when retrieving the document, and add a test confirming that users cannot download documents from another organization. The developer now has a plan that includes the security requirement, an implementation approach, and a test to verify it. In our internal benchmarking, incorporating these security rules reduced findings at PR time by approximately 20%. ## How it works Secure Spec uses the hooks exposed by coding agents to bring security review into the planning workflow. If you’re not familiar with hooks, they let us respond at specific points, such as when an agent is ready to implement a plan or is about to write code. At those points, we can block an operation and give the agent feedback. In Claude Code’s native plan mode, an agent requests the `ExitPlanMode` tool when it is ready to move from planning to implementation. A `PreToolUse` hook lets Secure Spec capture and submit the plan for review at that transition. As much as we’d like every harness to work the same way, each exposes a different set of hooks. We’ve spent time making the experience reliable across the different coding agents. The review evaluates the plan against the security rules customers have configured for their repositories, alongside security knowledge generated by Dam Secure. Feedback identifies the rules being violated and explains how the agent should update the plan. Here’s an example of that loop in practice, with an agent planning a scan count endpoint. The CLI supports Claude Code, Cursor, and GitHub Copilot CLI, with integrations for native planning workflows and plans written to files. The integration follows each editor’s available hooks so that review fits into the workflow developers already use. ## Where we’re going next A secure plan is the starting point. The next challenge is making sure the code keeps the promises made in that plan. We’re working on three major improvements to preventative security: - **Learning loops.** Make it easy to turn vulnerability findings into rules that help prevent the same mistakes from happening again. - **Risk assessment during planning.** Expand the review to identify key risks in the proposed design and recommend mitigations. - **Local scanning during implementation.** Check generated code for security issues and departures from the reviewed plan. Together, these will help us carry security context through more of the agent’s work, from the first blueprint to the code it produces. Your software empire is growing. We want to help you build security into its foundations. ## See Secure Spec in action Want to see what a security review looks like before the first line of code is written? [Book a demo →](https://damsecure.ai/get-started)