security-review-construction

Security Review Skill for Construction Systems

This skill ensures all construction software systems follow security best practices, protecting sensitive project data, financial information, and business intelligence.

When to Activate

• Building ERP/BIM system integrations
• Creating construction dashboards
• Handling cost/financial data
• Building document management systems
• Creating APIs for field data collection
• Integrating with external platforms (Procore, PlanGrid, etc.)
• Working with subcontractor/vendor data
• Processing payment applications

Construction-Specific Security Concerns

1. Financial Data Protection

# CRITICAL: Construction financial data security

# ❌ NEVER Do This
project_budget = 15000000  # Hardcoded in source
margin_percentage = 0.18   # Business-sensitive info in code

# ✅ ALWAYS Do This
import os
from cryptography.fernet import Fernet

# Load from secure configuration
project_config = load_secure_config(os.environ['PROJECT_CONFIG_PATH'])

# Encrypt sensitive data at rest
def encrypt_financial_data(data: dict) -> bytes:
    key = os.environ.get('ENCRYPTION_KEY')
    f = Fernet(key)
    return f.encrypt(json.dumps(data).encode())

Financial Data Checklist

• Cost estimates encrypted at rest
• Margin/markup data not exposed in logs
• Payment information tokenized
• Historical pricing protected from competitors
• Bid amounts secured until opening

2. BIM/CAD Data Security

# BIM data often contains proprietary design information

# ❌ NEVER store BIM directly in public cloud without encryption
s3.upload_file('model.ifc', bucket='public-bucket')

# ✅ ALWAYS encrypt and control access
def upload_bim_secure(file_path: str, project_id: str):
    # Encrypt file
    encrypted_path = encrypt_file(file_path)

    # Generate pre-signed URL with expiration
    presigned_url = s3.generate_presigned_url(
        'get_object',
        Params={
            'Bucket': 'secure-bim-bucket',
            'Key': f'{project_id}/{os.path.basename(file_path)}'
        },
        ExpiresIn=3600  # 1 hour expiration
    )

    # Log access
    audit_log.info(f"BIM access granted: {project_id}")

    return presigned_url