From 2c60db173d56466cd999da1b2eadda83b9e4b9c7 Mon Sep 17 00:00:00 2001 From: Julian Lechner Date: Thu, 24 Sep 2026 22:03:06 +0200 Subject: [PATCH] docs(security): strengthen data guidance --- shared/rules/security/references/data.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/shared/rules/security/references/data.md b/shared/rules/security/references/data.md index f58f89b..9dd9e8c 100644 --- a/shared/rules/security/references/data.md +++ b/shared/rules/security/references/data.md @@ -1,7 +1,11 @@ # Database and data security * Use parameterized queries or ORM parameter binding; never concatenate untrusted input into SQL. -* Use least-privilege database accounts and protect connection strings. -* Scope tenant-owned queries explicitly and prevent cross-tenant cache, logging, and diagnostic leakage. -* Collect and retain only necessary sensitive data; encrypt it in transit and at rest where appropriate. -* Avoid raw database errors and use transactions where integrity requires atomicity. +* Parameterize values in every query path, including raw SQL and stored procedures. Allowlist dynamic table names, columns, and sort directions. +* Use least-privilege database identities, separate application and migration privileges, and protect connection strings and backup credentials. +* Scope tenant- and user-owned reads, writes, joins, aggregates, background tasks, and cache keys explicitly. Do not rely on a caller having applied a filter elsewhere. +* Collect and retain only necessary sensitive data. Set retention and deletion behavior and protect backups, exports, replicas, logs, and analytics copies. +* Encrypt sensitive data in transit and at rest where appropriate; keep key access separate from database access. +* Use transactions and suitable constraints where integrity requires atomicity. Check concurrency and isolation around security-sensitive state changes. +* Avoid raw database errors and sensitive query parameters in responses, logs, traces, and metrics. +* Test injection, cross-tenant access, unauthorized mutation, stale updates, and cache isolation within the approved scope.