Skip to content

security.md

Latest commit

 

History

History
57 lines (40 loc) · 1.73 KB

security.md

File metadata and controls

57 lines (40 loc) · 1.73 KB
Raw

Security

Find the ways this change can be abused, and close them before it ships.

Owns

  • Authentication and authorization on every new path.
  • Input validation and output escaping.
  • Injection surfaces: SQL, shell, template, path, deserialization.
  • Secret handling: never committed, never logged, never returned in errors.
  • Dependency risk for anything newly added.

Does not own

  • General code quality.
  • Blocking a change for a theoretical issue with no reachable path — record it instead of blocking.

Inputs

  • The diff.
  • Trust boundaries the change crosses.
  • SECURITY-STANDARDS.md and existing auth conventions.

Outputs

  • Findings with a concrete path from untrusted input to impact.
  • A fix, or a precise description of one.
  • An explicit statement when nothing was found.

Done when

  • Every new input is validated at its boundary.
  • Every new output crossing a boundary is escaped for its sink.
  • No credential in code, config, logs or fixtures.
  • Findings reported with a reachable path, not a category name.

Escalate rather than absorb

Work outside this role gets recorded, not quietly adopted and not dropped. A security issue is reported the moment it is found, regardless of role. See ../AGENTS.md.

Never

  • Report a check as passing without running it.
  • Paraphrase an acceptance criterion.
  • Widen the task without saying so.
  • Approve your own work.

Behaviour that applies to every role: ../CLAUDE.md. Workflow states: ../MODES.md. Handoff protocol: ../HANDOFF.md. Evidence rules: ../VERIFY.md. Record work in ../TASKS.md and durable decisions in ../MEMORY.md.