mirror of
https://github.com/affaan-m/ECC.git
synced 2026-11-08 09:05:53 +00:00
Eric BellavanceandClaude Opus 5.5
1e895858d0
Kiro only loads steering files automatically in every conversation when they use `inclusion: always`; `auto` loads them only when the request matches the description. Switch the always-on steering files to `always` and update README, install.sh and docs accordingly. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
36 lines
1020 B
Markdown
36 lines
1020 B
Markdown
---
|
|
inclusion: always
|
|
name: security
|
|
description: Security best practices including mandatory checks, secret management, and security response protocol.
|
|
---
|
|
|
|
# Security Guidelines
|
|
|
|
## Mandatory Security Checks
|
|
|
|
Before ANY commit:
|
|
- [ ] No hardcoded secrets (API keys, passwords, tokens)
|
|
- [ ] All user inputs validated
|
|
- [ ] SQL injection prevention (parameterized queries)
|
|
- [ ] XSS prevention (sanitized HTML)
|
|
- [ ] CSRF protection enabled
|
|
- [ ] Authentication/authorization verified
|
|
- [ ] Rate limiting on all endpoints
|
|
- [ ] Error messages don't leak sensitive data
|
|
|
|
## Secret Management
|
|
|
|
- NEVER hardcode secrets in source code
|
|
- ALWAYS use environment variables or a secret manager
|
|
- Validate that required secrets are present at startup
|
|
- Rotate any secrets that may have been exposed
|
|
|
|
## Security Response Protocol
|
|
|
|
If security issue found:
|
|
1. STOP immediately
|
|
2. Use **security-reviewer** agent
|
|
3. Fix CRITICAL issues before continuing
|
|
4. Rotate any exposed secrets
|
|
5. Review entire codebase for similar issues
|