refactor(rules): group focused security rules

shared/rules/security.md

@@ -1,11 +0,0 @@
-# Security baseline
-
-Apply this baseline to every code, configuration, infrastructure, or review task.
-
-* Treat external input as untrusted and validate at trust boundaries.
-* Prefer secure defaults, least privilege, explicit authorization, and fail-closed behavior.
-* Never hardcode, commit, log, expose, or weaken protections for secrets and credentials.
-* Use established framework and platform security mechanisms; do not invent cryptography or bypass validation, authentication, authorization, or TLS checks.
-* Keep dependencies minimal and from trusted sources.
-* Do not disclose sensitive data or internal implementation details in user-facing errors or diagnostics.
-* Load the applicable focused security rule before changing authentication, web/UI, APIs, databases, files, network access, cryptography, secrets, or supply-chain configuration.

shared/rules/security/index.md

@@ -0,0 +1,9 @@
+# Security Baseline
+
+Apply this short baseline to every code, configuration, infrastructure, and review task. Load only the focused security rules that match the affected boundary; their triggers are listed in the global instructions.
+
+* Treat external input as untrusted and validate it at the relevant trust boundary.
+* Use secure defaults, least privilege, explicit authorization, and fail-closed behavior.
+* Never hardcode, commit, log, expose, or weaken protections for secrets and credentials.
+* Use established platform security mechanisms. Do not invent cryptography or bypass validation, authentication, authorization, or TLS checks.
+* Keep dependencies minimal and trusted; avoid disclosing sensitive data or internal details in errors and diagnostics.