version: 1
kind: rule
name: Security Guidelines Rule
description: Comprehensive security guidelines for secure coding practices, authentication, authorization, and vulnerability prevention
prompt: |
  Follow principles like Defense in Depth and Fail Securely; consider security from the start.
  Validate all user inputs and prevent Path Traversal and Command Injection attacks.
  Implement strong authentication/authorization using JWT and Role-Based Access Control (RBAC).
  Manage secrets securely via environment variables or external systems and conduct regular audits.
enhanced-prompt: |-
  ### Secure Coding Principles
  - **Defense in Depth**: Do not rely on a single security mechanism. Implement multiple layers of security controls, validate data at every boundary, and apply the principle of least privilege.
  - **Fail Securely**: Design systems to default to a secure state (e.g., access denied) upon failure. Do not expose sensitive information in error messages.
  - **Security by Design**: Consider security from the beginning of the development lifecycle and conduct threat modeling for new features.

  ### Input Validation and Sanitization
  - **Input Validation**: Use schema-based validation for all user inputs with libraries like Joi. Default to whitelist-based validation.
  - **Path Traversal Prevention**: When accessing the file system, always normalize paths and verify they are within an allowed directory to prevent path traversal attacks.
  - **Command Injection Prevention**: When executing external processes, use the `shell: false` option and clearly separate commands from arguments to prevent command injection.

  ### Authentication & Authorization
  - **Authentication**: Use JSON Web Tokens (JWT) to authenticate users. Tokens must have an expiration time and be signed with a secure secret key.
  - **Authorization**: Implement Role-Based Access Control (RBAC) to control resource access based on user permissions. Use both broad (e.g., `admin`) and fine-grained (e.g., `read:tasks`) permissions.

  ### Secrets Management
  - **Environment Variables**: Do not hardcode sensitive information. Manage it through environment variables using `.env` files and libraries like `dotenv`.
  - **External Secrets Management**: In production, it is recommended to use dedicated tools like HashiCorp Vault or AWS Secrets Manager to centrally and securely manage secrets and enable audit trails.

  ### Security Best Practices
  - **Secure Communication**: Use HTTPS/TLS to encrypt all external communications.
  - **Dependency Management**: Regularly scan for and patch security vulnerabilities in dependencies using tools like `npm audit` or Snyk.
  - **Logging and Monitoring**: Log security-related events (e.g., login failures, access denials) to detect and respond to suspicious activity.
  - **Regular Audits**: Periodically conduct security audits of the codebase and promptly address any found vulnerabilities.