caddis-plugin: Instructions file for GitHub Copilot

Security Guidelines

Based on OWASP Top 10 and security best practices for Python, SQL Server, and web applications.

Core Principle

Security First: When in doubt, choose the more secure option. All code should be secure by default.

---

A01: Broken Access Control

Principle of Least Privilege

# ✅ GOOD: Check specific permissions
def get_complaint(complaint_id: str, user: User) -> Complaint:
    complaint = repo.get(complaint_id)
    
    if not user.can_view_complaint(complaint):
        raise ForbiddenError("Not authorized to view this complaint")
    
    return complaint

# ❌ BAD: No access control
def get_complaint(complaint_id: str) -> Complaint:
    return repo.get(complaint_id)

Deny by Default

# ✅ GOOD: Explicit allow list
ALLOWED_ROLES = {"admin", "analyst", "viewer"}

def check_role(user_role: str) -> bool:
    return user_role in ALLOWED_ROLES

# ❌ BAD: Blacklist approach
BLOCKED_ROLES = {"guest"}

def check_role(user_role: str) -> bool:
    return user_role not in BLOCKED_ROLES

---

A02: Cryptographic Failures

Never Hardcode Secrets

# ❌ CRITICAL: Hardcoded credentials
DB_PASSWORD = "super_secret_123"
API_KEY = "sk-abc123xyz"

# ✅ GOOD: Environment variables
from pydantic_settings import BaseSettings

class Settings(BaseSettings):
    db_password: str = Field(..., repr=False)  # Hide in logs
    api_key: str = Field(..., repr=False)
    
    class Config:
        env_file = ".env"

settings = Settings()

Secure Password Hashing

# ✅ GOOD: Use bcrypt or argon2
from passlib.context import CryptContext

pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")

def hash_password(password: str) -> str:
    return pwd_context.hash(password)

def verify_password(plain_password: str, hashed_password: str) -> bool:
    return pwd_context.verify(plain_password, hashed_password)

# ❌ BAD: Weak hashing
import hashlib
def hash_password(password: str) -> str:
    return hashlib.md5(password.encode()).hexdigest()  # NEVER USE MD5