From 0bdd5f46b31840ed0294f943aaaf75bc26271de0 Mon Sep 17 00:00:00 2001
From: Julian Lechner <fraujulian@lechner.top>
Date: Thu, 24 Sep 2026 21:47:59 +0200
Subject: [PATCH] refactor(rules): group focused security rules

---
 shared/rules/security.md                              | 11 -----------
 shared/rules/security/index.md                        |  9 +++++++++
 .../{security-api.md => security/references/api.md}   |  0
 .../{security-auth.md => security/references/auth.md} |  0
 .../references/crypto.md}                             |  0
 .../{security-data.md => security/references/data.md} |  0
 .../references/files.md}                              |  0
 .../references/network.md}                            |  0
 .../references/supply-chain.md}                       |  0
 .../{security-web.md => security/references/web.md}   |  0
 10 files changed, 9 insertions(+), 11 deletions(-)
 delete mode 100644 shared/rules/security.md
 create mode 100644 shared/rules/security/index.md
 rename shared/rules/{security-api.md => security/references/api.md} (100%)
 rename shared/rules/{security-auth.md => security/references/auth.md} (100%)
 rename shared/rules/{security-crypto.md => security/references/crypto.md} (100%)
 rename shared/rules/{security-data.md => security/references/data.md} (100%)
 rename shared/rules/{security-files.md => security/references/files.md} (100%)
 rename shared/rules/{security-network.md => security/references/network.md} (100%)
 rename shared/rules/{security-supply-chain.md => security/references/supply-chain.md} (100%)
 rename shared/rules/{security-web.md => security/references/web.md} (100%)

diff --git a/shared/rules/security.md b/shared/rules/security.md
deleted file mode 100644
index 480be9f..0000000
--- a/shared/rules/security.md
+++ /dev/null
@@ -1,11 +0,0 @@
-# Security baseline
-
-Apply this baseline to every code, configuration, infrastructure, or review task.
-
-* Treat external input as untrusted and validate at trust boundaries.
-* Prefer secure defaults, least privilege, explicit authorization, and fail-closed behavior.
-* Never hardcode, commit, log, expose, or weaken protections for secrets and credentials.
-* Use established framework and platform security mechanisms; do not invent cryptography or bypass validation, authentication, authorization, or TLS checks.
-* Keep dependencies minimal and from trusted sources.
-* Do not disclose sensitive data or internal implementation details in user-facing errors or diagnostics.
-* Load the applicable focused security rule before changing authentication, web/UI, APIs, databases, files, network access, cryptography, secrets, or supply-chain configuration.
diff --git a/shared/rules/security/index.md b/shared/rules/security/index.md
new file mode 100644
index 0000000..bd4194d
--- /dev/null
+++ b/shared/rules/security/index.md
@@ -0,0 +1,9 @@
+# Security Baseline
+
+Apply this short baseline to every code, configuration, infrastructure, and review task. Load only the focused security rules that match the affected boundary; their triggers are listed in the global instructions.
+
+* Treat external input as untrusted and validate it at the relevant trust boundary.
+* Use secure defaults, least privilege, explicit authorization, and fail-closed behavior.
+* Never hardcode, commit, log, expose, or weaken protections for secrets and credentials.
+* Use established platform security mechanisms. Do not invent cryptography or bypass validation, authentication, authorization, or TLS checks.
+* Keep dependencies minimal and trusted; avoid disclosing sensitive data or internal details in errors and diagnostics.
diff --git a/shared/rules/security-api.md b/shared/rules/security/references/api.md
similarity index 100%
rename from shared/rules/security-api.md
rename to shared/rules/security/references/api.md
diff --git a/shared/rules/security-auth.md b/shared/rules/security/references/auth.md
similarity index 100%
rename from shared/rules/security-auth.md
rename to shared/rules/security/references/auth.md
diff --git a/shared/rules/security-crypto.md b/shared/rules/security/references/crypto.md
similarity index 100%
rename from shared/rules/security-crypto.md
rename to shared/rules/security/references/crypto.md
diff --git a/shared/rules/security-data.md b/shared/rules/security/references/data.md
similarity index 100%
rename from shared/rules/security-data.md
rename to shared/rules/security/references/data.md
diff --git a/shared/rules/security-files.md b/shared/rules/security/references/files.md
similarity index 100%
rename from shared/rules/security-files.md
rename to shared/rules/security/references/files.md
diff --git a/shared/rules/security-network.md b/shared/rules/security/references/network.md
similarity index 100%
rename from shared/rules/security-network.md
rename to shared/rules/security/references/network.md
diff --git a/shared/rules/security-supply-chain.md b/shared/rules/security/references/supply-chain.md
similarity index 100%
rename from shared/rules/security-supply-chain.md
rename to shared/rules/security/references/supply-chain.md
diff --git a/shared/rules/security-web.md b/shared/rules/security/references/web.md
similarity index 100%
rename from shared/rules/security-web.md
rename to shared/rules/security/references/web.md