# Security Guidelines

> **Canonical security checklist.** This is the single source for the security pre-commit gate. The deep audit rubric (OWASP Top 10, per-category detection) lives in the `security-reviewer` agent — other rules/commands reference these two, they do not restate security items.

## Mandatory Security Checks

Before ANY commit:
- [ ] No hardcoded secrets (API keys, passwords, tokens)
- [ ] All user inputs validated
- [ ] SQL injection prevention (parameterized queries)
- [ ] XSS prevention (sanitized HTML)
- [ ] Path traversal prevention (sanitize file paths built from user input)
- [ ] CSRF protection enabled
- [ ] Authentication/authorization verified
- [ ] Rate limiting on authentication + expensive endpoints
- [ ] Error messages don't leak sensitive data (no stack traces in responses)

## Secret Management

- NEVER hardcode secrets in source code
- ALWAYS use environment variables or a secret manager
- Validate that required secrets are present at startup
- Rotate any secrets that may have been exposed

## Security Response Protocol

If security issue found:
1. STOP immediately
2. Use **security-reviewer** agent
3. Fix CRITICAL issues before continuing
4. Rotate any exposed secrets
5. Sweep for the same pattern within the changed files + their direct call sites (not the entire codebase — bound the scope; escalate to a full audit only if the pattern is systemic)