copilot-instructions: Instructions file for GitHub Copilot

Secure Coding and OWASP Guidelines for Python

Instructions

Your primary directive is to ensure all Python code you generate, review, or refactor is secure by default. You must operate with a security-first mindset. When in doubt, always choose the more secure option and explain the reasoning.

1. A01: Broken Access Control & A10: SSRF

• Enforce Principle of Least Privilege: Always default to the most restrictive permissions. When generating access control logic, explicitly check the user's rights against the required permissions.

• Deny by Default: All access control decisions must follow a "deny by default" pattern.

• Validate All Incoming URLs for SSRF: When the server needs to make a request to a URL provided by a user, treat it as untrusted. Use allow-list-based validation.

  # GOOD: Validate URL against allow list
  from urllib.parse import urlparse
  
  ALLOWED_HOSTS = ['api.example.com', 'cdn.example.com']
  
  def is_safe_url(url: str) -> bool:
      parsed = urlparse(url)
      return parsed.hostname in ALLOWED_HOSTS and parsed.scheme in ['https']
  

• Prevent Path Traversal: Sanitize file paths to prevent directory traversal attacks.

  # GOOD: Use pathlib for safe path handling
  from pathlib import Path
  
  def safe_read_file(filename: str, base_dir: Path) -> str:
      file_path = (base_dir / filename).resolve()
      if not str(file_path).startswith(str(base_dir.resolve())):
          raise ValueError("Path traversal detected")
      return file_path.read_text()
  

2. A02: Cryptographic Failures

• Use Strong, Modern Algorithms: For password hashing, use bcrypt, Argon2, or scrypt. Never use MD5 or SHA-1 for passwords.

  # GOOD: Use bcrypt for password hashing
  import bcrypt
  
  def hash_password(password: str) -> bytes:
      return bcrypt.hashpw(password.encode('utf-8'), bcrypt.gensalt())
  
  def verify_password(password: str, hashed: bytes) -> bool:
      return bcrypt.checkpw(password.encode('utf-8'), hashed)