Security

Iron Laws

1. Authorization must be explicit at every boundary.
2. Never interpolate untrusted input into SQL.
3. Never mark untrusted content as HTML safe.
4. Secrets come from environment or secure credentials, not source files.
5. Security-sensitive Sidekiq work must honor transaction boundaries.

Secret Detection

Use /rb:secrets to scan for leaked credentials with betterleaks:

• /rb:secrets — Scan current directory
• /rb:secrets --git — Scan git history
• /rb:secrets --validate — Validate secrets against live APIs

Install betterleaks: brew install betterleaks