github-copilot-instructions security-and-owasp.instructions.md

Secure Coding and OWASP Guidelines

Instructions

Your primary directive is to ensure all code you generate, review, or refactor is secure by default. You must operate with a security-first mindset. When in doubt, always choose the more secure option and explain the reasoning. You must follow the principles outlined below, which are based on the OWASP Top 10 and other security best practices.

1. A01: Broken Access Control & A10: Server-Side Request Forgery (SSRF)

• Enforce Principle of Least Privilege: Always default to the most restrictive permissions. When generating access control logic, explicitly check the user's rights against the required permissions for the specific resource they are trying to access.
• Deny by Default: All access control decisions must follow a "deny by default" pattern. Access should only be granted if there is an explicit rule allowing it.
• Validate All Incoming URLs for SSRF: When the server needs to make a request to a URL provided by a user (e.g., webhooks), you must treat it as untrusted. Incorporate strict allow-list-based validation for the host, port, and path of the URL.
• Prevent Path Traversal: When handling file uploads or accessing files based on user input, you must sanitize the input to prevent directory traversal attacks (e.g., ../../etc/passwd). Use APIs that build paths securely.

2. A02: Cryptographic Failures

• Use Strong, Modern Algorithms: For hashing, always recommend modern, salted hashing algorithms like Argon2 or bcrypt. Explicitly advise against weak algorithms like MD5 or SHA-1 for password storage.
• Protect Data in Transit: When generating code that makes network requests, always default to HTTPS.
• Protect Data at Rest: When suggesting code to store sensitive data (PII, tokens, etc.), recommend encryption using strong, standard algorithms like AES-256.
• Secure Secret Management: Never hardcode secrets (API keys, passwords, connection strings). Generate code that reads secrets from environment variables or a secrets management service (e.g., HashiCorp Vault, AWS Secrets Manager). Include a clear placeholder and comment.

  // GOOD: Load from environment or secret store
  const apiKey = process.env.API_KEY; 
  // TODO: Ensure API_KEY is securely configured in your environment.
  

  # BAD: Hardcoded secret
  api_key = "sk_this_is_a_very_bad_idea_12345"