From d71db161985f22abbb18c5099054c173329a2362 Mon Sep 17 00:00:00 2001 From: Julian lechner Date: Wed, 30 Sep 2026 09:38:41 +0200 Subject: [PATCH] docs(security): add focused rule index --- shared/rules/security/index.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/shared/rules/security/index.md b/shared/rules/security/index.md index 2aaf1d6..994b21a 100644 --- a/shared/rules/security/index.md +++ b/shared/rules/security/index.md @@ -9,3 +9,19 @@ Apply this language- and framework-independent baseline to every code, configura * Protect secrets and sensitive data throughout their lifecycle. Minimize collection and retention; never hardcode, commit, log, expose, or send them to unauthorized destinations. * Use maintained platform mechanisms for authentication, authorization, cryptography, serialization, and transport security. Do not invent cryptography or bypass validation, certificate checks, or other controls. * Keep dependencies and privileges minimal. Return safe errors and diagnostics without exposing secrets or internal details. + +## Focused Security Rules + +Load only the topic rules that match the affected boundary. + +| Topic | Codex rule | Claude skill | +| --- | --- | --- | +| Authentication, authorization, sessions, tokens, permissions, and tenants | `references/auth.md` | `rules-security-auth` | +| HTTP, requests, serialization, and endpoints | `references/api.md` | `rules-security-api` | +| Browsers, cookies, redirects, XSS, and CSRF | `references/web.md` | `rules-security-web` | +| Databases, queries, persistence, and sensitive data | `references/data.md` | `rules-security-data` | +| Files, uploads, archives, paths, processes, IPC, and deserialization | `references/files.md` | `rules-security-files` | +| Network access, URLs, proxies, TLS, and SSRF | `references/network.md` | `rules-security-network` | +| Cryptography, secrets, keys, and credentials | `references/crypto.md` | `rules-security-crypto` | +| Dependencies, packages, plugins, builds, deployment, and CI | `references/supply-chain.md` | `rules-security-supply-chain` | +| Active security testing and exploit validation | `references/testing.md` | `rules-security-testing` |