fraujulian/MyAiConfiguration
1
0 Fork 0
Code Issues Pull Requests Actions Activity

docs(security): define baseline and testing scope

Browse Source
This commit is contained in:
Julian lechner committed 2026-09-30 09:23:52 +02:00
1 parent da11841565
commit 5c1795a601
5 files changed
+20 -13
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

shared/rules/security/references/api.md
+1 -1
View File
@@ -9,4 +9,4 @@
* Return only authorized fields. Do not expose stack traces, internal models, secrets, or implementation details in API responses or errors.
* Prefer explicit DTOs and schemas; reject unknown or ambiguous fields when accepting them could alter privileged state.
* Keep authorization, validation, serialization, and error responses consistent with the published schema and supported clients.
* Test malformed, oversized, unauthenticated, unauthorized, cross-user, cross-tenant, and duplicate requests within the approved scope.
* Test malformed, oversized, unauthenticated, unauthorized, cross-user, cross-tenant, and duplicate requests within the user's requested scope.