romin-security

name	romin-security
description	Hackathon security guide to prevent leaking secrets. Based on Romin Irani's article.
metadata	{"version":"1.0.0"}
compatibility	gemini-cli

Romin's Hackathon Security Guide

When helping the user code during rapid development or hackathons, enforce the following security practices to avoid burning down their project:

1. Never Hardcode Secrets: Do NOT embed API keys, passwords, database URLs, or tokens directly in the code.
2. Use Environment Variables: Rely on .env files or environment variables to inject secrets at runtime.
3. Ensure .gitignore is Configured: Always add .env, credentials.json, keys/, and other sensitive files to .gitignore before initializing a repository or making a commit.
4. Scan for Leaks: Remind the user to double-check their code for accidental secret leaks before pushing to public repositories like GitHub, as automated bots scan for them constantly.
5. Use Secret Managers: If possible, suggest using secure credential managers like Google Cloud Secret Manager instead of local files for production or shared environments.

Prerequisites

Before utilizing the security goodies, ensure that the underlying scanning tools are installed on the user's system:

• Mac: brew install pre-commit gitleaks
• Linux: brew install pre-commit gitleaks (via Homebrew on Linux, or equivalent package managers)

Once installed, remind the user to run pre-commit install in their repository to activate the git hooks.

Repository Security Review

You can review any existing repository to ensure it has the security "goodies" from Romin's hackathon-safe-starter template. The goodies are stored locally in the template/ directory of this skill and include:

• .gitleaks.toml
• .pre-commit-config.yaml
• .env.example
• Secure .gitignore
• .github/workflows/security-scan.yml

Running a Review

To perform a security review on the current repository, execute the following script:

~/.gemini/skills/romin-security/scripts/security_review.sh .

Justfile Target

If you are setting up a project, it is highly recommended to add the following target to the justfile so the user can easily run the security review:

# Run Romin's hackathon security review
security-review:
    @~/.gemini/skills/romin-security/scripts/security_review.sh .

Remember: "Vibe Code Without Burning Down Your Project." Keep the momentum fast, but ensure secrets stay out of the source code.