Security Standards

Priority: P0 (CRITICAL)

Always-Apply Rules

Apply these on every code write, regardless of context:

• No hardcoded secrets: Use environment variables or secret managers. Never commit keys, passwords, or tokens to source control.
• No raw SQL strings: Use parameterized queries or ORMs — WHERE id = ${userId} always wrong.
• No stacktraces in prod: Return generic error codes; log full detail server-side only.

Workflow

Activate when: implementing auth, encryption, authorization, input handling, or any security-sensitive feature.

1. Identify trust boundaries — map every data entry point (API, UI, CSV, webhook).
2. Validate and sanitize all external input at each boundary.
3. Apply least privilege to users, services, and containers.
4. Verify with SAST/DAST scanners in CI before merge.