version: 1
rules:
  require_primary_source: true
  require_version_applicability: true
  require_corroboration_for_major_change: true
  reject_unsourced_claims: true
  automatic_apply: false

# El contexto de la empresa no es una fuente de la profesión: vive en
# organization/roles/security-engineer.md dentro de cada instalación.
sources:
  - name: NIST Secure Software Development Framework
    url: https://csrc.nist.gov/pubs/sp/800/218/final
    tier: standard
    topics: [secure-development, supply-chain, vulnerabilities]
  - name: OWASP ASVS
    url: https://owasp.org/www-project-application-security-verification-standard/
    tier: standard
    topics: [application-security, verification, controls]
  - name: MITRE CWE
    url: https://cwe.mitre.org/
    tier: advisory
    topics: [weaknesses, causes, mitigations]
  - name: CISA Known Exploited Vulnerabilities
    url: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
    tier: advisory
    topics: [known-exploitation, prioritization]
  - name: Node.js Security Releases
    url: https://nodejs.org/en/blog/vulnerability/
    tier: advisory
    topics: [runtime-advisories, cve, patch-lines]
  - name: GitHub Advisory Database
    url: https://github.com/advisories
    tier: advisory
    topics: [ecosystem-advisories, npm, github-actions, malware]
  - name: GitHub Changelog
    url: https://github.blog/changelog/
    tier: platform
    topics: [npm-registry, tokens, publishing, actions]
  # Marco citado, no leído: la página del recurso publica la lista (2025-12-09) y ofrece la
  # descarga del documento completo, que no se abrió. Hasta abrirlo, no atribuir ningún
  # identificador de categoría a un hallazgo (informe 2026-08-16, pregunta abierta 4).
  - name: OWASP Top 10 for Agentic Applications
    url: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
    tier: standard
    topics: [agentic-risk, tool-use, identity, excessive-agency]