code-security

Code Security Guidelines

Comprehensive security rules for writing secure code across 15+ languages. Covers OWASP Top 10, infrastructure security, and coding best practices with 28 rule categories.

How to Use This Skill

Proactive mode — When writing or reviewing code, automatically check for relevant vulnerabilities based on the language and patterns present. You don't need to wait for the user to ask about security.

Reactive mode — When the user asks about security, use the categories below to find the relevant rule file, then read it for detailed vulnerable/secure code examples.

Workflow

1. Identify the language and what the code does (handles input? queries a DB? reads files?)
2. Check the relevant rules below — focus on Critical and High impact first
3. Read the specific rule file from rules/ for detailed code examples in that language
4. Apply the secure patterns, or flag the vulnerable patterns if reviewing

Language-Specific Priority Rules

When writing code in these languages, check these rules first:

Language	Priority Rules to Check
Python	SQL injection, command injection, path traversal, code injection, SSRF, insecure crypto
JavaScript/TypeScript	XSS, prototype pollution, code injection, insecure transport, CSRF
Java	SQL injection, XXE, insecure deserialization, insecure crypto, SSRF
Go	SQL injection, command injection, path traversal, insecure transport
C/C++	Memory safety, unsafe functions, command injection, path traversal
Ruby	SQL injection, command injection, code injection, insecure deserialization
PHP	SQL injection, XSS, command injection, code injection, path traversal
HCL/YAML	Terraform (AWS/Azure/GCP), Kubernetes, Docker, GitHub Actions

Categories

Critical Impact

• SQL Injection (rules/sql-injection.md) - Use parameterized queries, never concatenate user input
• Command Injection (rules/command-injection.md) - Avoid shell commands with user input, use safe APIs
• XSS (rules/xss.md) - Escape output, use framework protections
• XXE (rules/xxe.md) - Disable external entities in XML parsers
• Path Traversal (rules/path-traversal.md) - Validate and sanitize file paths
• Insecure Deserialization (rules/insecure-deserialization.md) - Never deserialize untrusted data
• Code Injection (rules/code-injection.md) - Never eval() user input
• Hardcoded Secrets (rules/secrets.md) - Use environment variables or secret managers
• Memory Safety (rules/memory-safety.md) - Prevent buffer overflows, use-after-free (C/C++)

High Impact

• Insecure Crypto (rules/insecure-crypto.md) - Use SHA-256+, AES-256, avoid MD5/SHA1/DES
• Insecure Transport (rules/insecure-transport.md) - Use HTTPS, verify certificates
• SSRF (rules/ssrf.md) - Validate URLs, use allowlists
• JWT Issues (rules/authentication-jwt.md) - Always verify signatures
• CSRF (rules/csrf.md) - Use CSRF tokens on state-changing requests
• Prototype Pollution (rules/prototype-pollution.md) - Validate object keys in JavaScript

Infrastructure

• Terraform AWS/Azure/GCP (rules/terraform-aws.md, rules/terraform-azure.md, rules/terraform-gcp.md) - Encryption, least privilege, no public access
• Kubernetes (rules/kubernetes.md) - No privileged containers, run as non-root
• Docker (rules/docker.md) - Don't run as root, pin image versions
• GitHub Actions (rules/github-actions.md) - Avoid script injection, pin action versions

Medium/Low Impact

• Regex DoS (rules/regex-dos.md) - Avoid catastrophic backtracking
• Race Conditions (rules/race-condition.md) - Use proper synchronization
• Correctness (rules/correctness.md) - Avoid common logic bugs
• Best Practices (rules/best-practice.md) - General secure coding patterns

See rules/_sections.md for the full index with CWE/OWASP references.

Quick Reference

Vulnerability	Key Prevention
SQL Injection	Parameterized queries
XSS	Output encoding
Command Injection	Avoid shell, use APIs
Path Traversal	Validate paths
SSRF	URL allowlists
Secrets	Environment variables
Crypto	SHA-256, AES-256