security

Security Rule

Prevents accidental commits of private, sensitive, or confidential documentation and data.

Configuration: This rule uses protected paths configured in foundation-config.yaml under security.pre_commit_audit.protected_paths.

Pre-Commit Security Audit

Before staging or committing ANY changes, agents MUST perform the following checks:

1. Protected Paths Check

Check for any files in protected paths (configured in foundation-config.yaml):

# Load protected paths from config (example paths shown)
PROTECTED_PATHS=("docs/private/" "data/")  # Configured per repository

# Check unstaged changes
for path in "${PROTECTED_PATHS[@]}"; do
  if git status --porcelain | grep -E "^[AM]|^\?\?" | grep -qE "$path"; then
    echo "❌ SECURITY VIOLATION: Files in $path detected!"
    git status --porcelain | grep -E "^[AM]|^\?\?" | grep "$path"
    exit 1
  fi
done

# Check staged changes (if any exist)
for path in "${PROTECTED_PATHS[@]}"; do
  if git diff --cached --name-only 2>/dev/null | grep -qE "$path"; then
    echo "❌ SECURITY VIOLATION: Files in $path already staged!"
    git diff --cached --name-only | grep "$path"
    exit 1
  fi
done

If any files match protected paths, ABORT the commit immediately and alert the user.

2. Environment Files Check

Check for any .env* files (should be in .gitignore but verify):

if git status --porcelain | grep -qE "\.env"; then
  echo "❌ SECURITY VIOLATION: .env files detected!"
  git status --porcelain | grep "\.env"
  exit 1
fi

if git diff --cached --name-only 2>/dev/null | grep -qE "\.env"; then
  echo "❌ SECURITY VIOLATION: .env files already staged!"
  git diff --cached --name-only | grep "\.env"
  exit 1
fi

If any .env* files are detected, ABORT the commit.

Configuration: Enable/disable via security.pre_commit_audit.check_env_files in foundation-config.yaml.

3. Sensitive File Pattern Check

Check for files with sensitive naming patterns:

# Check for files with "secret" or "private" in path (excluding legitimate code)
git status --porcelain | grep -vE "(test|spec|property_keys)" | grep -iE "(secret|private)" | grep -vE "$(IFS='|'; echo "${PROTECTED_PATHS[*]}")" && echo "WARNING: Suspicious file patterns detected" && exit 1