c6c1364dd6
* Sync agent pipeline artifacts to 0.6.0. Add model routing defaults, L2 role updates, convoy telemetry, and manifest tracking without touching unrelated in-progress work. * Record tcg-vault interactive sync (kept local L1/L3 customizations). Update last_synced_at after reviewing behind/conflict artifacts; no overwrites applied. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(agent-pipeline): sync 0.6.0 — implementer Mode 2 fix pass + UI designer - role-implementer Mode 2 (fix pass) and role-reviewer hand-off - role-ui-designer + model-routing updates from upstream 783e2a3 - manifest last_synced_at bumped Co-authored-by: Cursor <cursoragent@cursor.com> * chore(agent-pipeline): sync v0.7.0 model routing Composer Standard for architect, Grok for audit fan-out, Sonnet 5 escalation path. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(agent-pipeline): finish 0.6.0/0.7.0 sync on branch Install security baseline, convoy planning, security-audit and ui-ux-pro-max skills; align PR template and metrics docs with convoy-metrics-gate; refresh manifest hashes while keeping tcg-vault-local L1/L3 customizations. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
39 lines
1.6 KiB
Text
39 lines
1.6 KiB
Text
---
|
|
description: Security baseline — secrets, input validation, auth boundaries, logging
|
|
alwaysApply: true
|
|
---
|
|
|
|
# Security baseline
|
|
|
|
Complements `no-go-zones.mdc` (what not to touch) with **how to write secure code**. For auth specifics, see `auth-patterns.mdc` and `api-routes.mdc` when installed.
|
|
|
|
## Secrets
|
|
|
|
- Never commit credentials, API keys, tokens, or private keys. Use environment variables.
|
|
- Never log passwords, session tokens, or full payment details.
|
|
- Never expose secrets to the browser (`NEXT_PUBLIC_*` is public forever).
|
|
- If a secret appears in git history, rotate it — deleting the commit line is not enough.
|
|
|
|
## Input & output
|
|
|
|
- Validate every request body and untrusted query param at the API boundary (Zod or repo equivalent).
|
|
- Parameterize database queries — no string concatenation with user input.
|
|
- Return generic errors to clients; put details in server logs only.
|
|
- Do not reflect raw user input into HTML without sanitization.
|
|
|
|
## Auth
|
|
|
|
- Protected routes must call the repo's auth helper **before** business logic.
|
|
- Authorization: verify the session user may access **this** resource (IDOR prevention).
|
|
- Rate-limit authentication endpoints (login, register, password reset).
|
|
- No dev-only auth bypass in production code paths.
|
|
|
|
## Dependencies
|
|
|
|
- Run `npm audit` / `pnpm audit` before merging dependency changes.
|
|
- Do not add packages for one-liners when the stdlib or an existing dep suffices.
|
|
|
|
## Pipeline
|
|
|
|
- For convoy work, run `role-security-auditor` in the audit fan-out unless `skip: security` is set.
|
|
- Security findings with severity ≥ 3 block merge unless the convoy documents an accepted risk.
|