Security Best Practices

Workflow

1. Identify languages and frameworks in scope — inspect the repo if unclear. Cover both frontend and backend for web apps.
2. Load matching references from references/. Filename format: <language>-<framework>-<stack>-security.md. Also check <language>-general-<stack>-security.md. For unspecified web frontends, check javascript-general-web-frontend-security.md.
3. If no references match, apply well-known security practices for the detected stack. When generating a report, note that concrete guidance is unavailable.

Modes

1. Secure-by-default coding — apply guidance to all new code going forward
2. Passive detection — flag critical vulnerabilities encountered while working; focus on highest-impact issues
3. Security report — produce a prioritized report (see Report Format below), then offer to fix findings

Overrides

Project docs or prompt files may override specific practices. Respect these overrides — suggest documenting the rationale so future work stays consistent.

Report Format