| name | application-security-requirements |
| description | OWASP-framed security and privacy rules for this small Hono URL proxy. Use when writing or reviewing code that handles proxy payloads, UUIDv5 short keys, KV short-link storage, Obsidian URI construction, source URLs, Open Graph metadata, environment variables, robots/indexing behavior, or npm dependency changes.
|
Application Security Requirements
Apply these rules when reviewing the security implications of any code change in this project. The app is public and stores short Obsidian bridge links in Workers KV for 30 days; most risk comes from treating encoded URL data as trusted, leaking target metadata, omitting expiry, or adding unnecessary dependencies.
Secret and Environment-Variable Handling
Configuration is intentionally small. Public base URL configuration is safe to expose, but credentials and decoded note data do not belong in source, logs, or client-visible environment variables.
Guidelines:
- SHOULD read secret-handling.md when a change touches environment variables, logging, diagnostics, or configuration docs.
- MUST keep literal secrets, private environment files, decoded note metadata, and generated Obsidian URIs out of the repository and logs.
- MUST keep
.env.example configuration details current when configuration changes; README may only point developers to the example file.
Input Validation
Every proxy URL is attacker-controlled input until it passes the route's decoding and validation rules. Validated payloads are the only values that may reach metadata, UI, or custom-protocol URI construction.
Guidelines:
- SHOULD read input-validation.md when changing key handling, payload schemas, field limits, source URL handling, or Obsidian URI construction.
- MUST validate decoded JSON through the canonical validation helpers before use.
- MUST preserve fail-closed behavior for malformed short keys and invalid payload fields.
Privacy and Exposure Control
Short keys are obfuscation, not access control. Anyone with a live short URL can resolve its vault, path, title, summary, and optional source URL through the proxy until the KV entry expires.
Guidelines:
- SHOULD read access-control.md when changing public route behavior, crawler behavior, indexing metadata, UI exposure, storage, or auth assumptions.
- MUST NOT claim proxy URLs are private, encrypted, authenticated, or secure.
- MUST keep short-link persistence limited to validated Obsidian bridge payloads with the configured 30-day KV TTL unless the user explicitly accepts a product-scope change.
Supply Chain
This app should stay small. New packages add review, audit, bundle, and runtime-boundary risk, so built-in Web, Node, Hono, and zod APIs are the default.
Guidelines:
- SHOULD read supply-chain.md when adding, removing, or upgrading npm dependencies.
- MUST keep
package.json and package-lock.json synchronized.
- SHOULD reject dependencies that duplicate built-in or existing local functionality.
