security-defined

Requires root-level or operation-level security and verifies that every referenced security scheme exists.

Attribute	Value
Category	Security
Maturity	Baseline
Starter–Complete	Error

See it fail

paths:
  /health:
    get:
      responses: { '200': { description: OK } }

Fix it

Declare a security scheme and reference it at root or operation level.

Exceptions

Exclude intentional public operations with exact path, substring pathContains, or regex pathPattern; optionally constrain methods.

security-defined:
  severity: error
  options:
    exceptions:
      - path: /health
        methods: [get]

Nearby: security-scheme-missing, no-empty-security.