secure-development

name	secure-development
description	Enforces strict 'Zero-Leak' security practices, including secret management, gitignore rules, and environment variable protocols. Use when starting new projects or rigorously auditing existing ones.

Secure Development & Zero-Leak Protocol

When to use this skill

• Starting ANY new project (backend, frontend, or tools).
• When the user mentions "Security", "Secrets", "API Keys", or "Leaks".
• Before deploying or committing code.

Instructions

1. The Zero-Leak Policy

NEVER commit secrets, API keys, credentials, or .env files to git. If a secret is committed, it is considered compromised and must be revoked immediately.

2. Global Exclusion Rules (.gitignore)

You MUST ensure the .gitignore file includes the following "Ironclad" section:

# Data & Secrets (MANDATORY)
.env
.env.*
!.env.example
*.pem
*.key
*.p12
*.pfx
client_secret*.json
credentials.json
*_token.json

Exception: .env.example must be tracked, but meaningful values must be empty.

3. Variable Management: The "Accumulate" Rule

• Single Source of Truth: The .env file is the source of truth for secrets.
• Template Sync: Every time you add a variable to .env, you MUST immediately add it to .env.example with an empty value.
• Verification: Run diff <(grep -o '^[^=]*' .env | sort) <(grep -o '^[^=]*' .env.example | sort) to ensure parity.

4. Code Scanning

• Generally avoid hardcoding keys (e.g., AIza...) in source code.
• Use os.environ.get("KEY") or process.env.KEY strictly.

5. Remediation (If a leak occurs)

1. Revoke the key at the provider immediately.
2. Rotate the key (generate new).
3. Scrub historical commits if necessary (git filter-repo).