weseek__growi/.claude/rules/security.md

Security Guidelines

Mandatory Security Checks

Before ANY commit:

• No hardcoded secrets (API keys, passwords, tokens)
• All user inputs validated and sanitized
• NoSQL injection prevention (use Mongoose properly)
• XSS prevention (sanitize HTML output)
• CSRF protection enabled
• Authentication/authorization verified
• Error messages don't leak sensitive data

Secret Management

// NEVER: Hardcoded secrets
const apiKey = "sk-xxxxx"

// ALWAYS: Environment variables
const apiKey = process.env.API_KEY
if (!apiKey) {
  throw new Error('API_KEY not configured')
}

Security Response Protocol

If security issue found:

1. STOP immediately
2. Use security-reviewer agent
3. Fix CRITICAL issues before continuing
4. Rotate any exposed secrets