feat(core): add asyncapi-operation-security-defined lint rule

[harshit078]

What/Why/How?

• Added asyncapi-operation-security-defined rule for AsyncAPI 2.x which reports when a security scheme referenced from an operation or server security array is not defined in ``components.securitySchemes.

Reference

#2667

Testing

Screenshots (optional)

Check yourself

• This PR follows the contributing guide
• All new/updated code is covered by tests
• Core code changed? - Tested with other Redocly products (internal contributions only)
• New package installed? - Tested in different environments (browser/node)
• Documentation update has been considered

Security

• The security impact of the change has been considered
• Code follows company security practices and guidelines

---

Note

Medium Risk
Introduces a new built-in lint rule and enables it by default in AsyncAPI minimal/recommended configs, which may surface new errors/warnings in existing AsyncAPI projects after upgrade.

Overview
Adds a new AsyncAPI lint rule, security-defined, that reports when an operation/server security entry references a scheme not defined in components.securitySchemes (AsyncAPI 2.x) or when an AsyncAPI 3.0 security $ref either points outside #/components/securitySchemes or resolves to an undefined scheme.

Registers the rule for both async2 and async3, adds test coverage, and enables it across the built-in minimal, recommended, recommended-strict, spec, and all config presets (plus config snapshot updates). Documentation is updated to list the rule, add a dedicated rule page, include it in ruleset templates/sidebars, and publish a changeset.

^{Reviewed by Cursor Bugbot for commit bf96d18. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: bf96d18

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@redocly/openapi-core	Minor
@redocly/cli	Minor
@redocly/respect-core	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vadyvas]

I would suggest a slightly different approach:

1. keep the AsyncAPI logic separate and do not reuse shared logic from the OAS rule
2. use the same rule name, security-defined, for AsyncAPI as well, and register the AsyncAPI implementation in the AsyncAPI ruleset
3. do not update the v1 docs in this PR

I think this would make the change smaller, clearer, and safer.

Thank you for the contribution, overall the PR looks good

[vadyvas]

left a few comments, could you take a look?

[vadyvas]

Please add support for AsyncAPI 3 as well. Right now the rule only applies to AsyncAPI2

[harshit078]

okay sure !

[vadyvas]

The code uses the rule name security-defined, but the docs still say asyncapi-operation-security-defined
Can you update related changes?

[vadyvas]

Please don’t add this rule to the v1 docs

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 75bf960. Configure here.}