security-guidelines

name	security-guidelines
description	Application security guidelines covering input validation, XSS prevention, SQL injection, authentication, and secrets management. Auto-loaded when implementing authentication, handling user input, or managing secrets.
category	guideline
user-invocable	false

Security Guidelines

Core Principles

1. Defense in depth — Multiple layers of security
2. Least privilege — Minimum permissions required
3. Fail secure — Default to denying access
4. Never trust input — Validate everything from external sources
5. Keep secrets secret — Never expose sensitive data

Input Validation

Always validate external input (URL params, request body, query strings, headers, file uploads, WebSocket messages).

import { z } from 'zod';

const UserInputSchema = z.object({
  email: z.string().email().max(),
  : z.().().(),
  : z.().().().().(),
});

 () {
   .(input);
}


 ():  {
   (!.(id)) {
      ();
  }
   id;
}