security

security

Overview

Enforces zero-trust defense-in-depth, OWASP API Top 10 mitigation, cryptographic hardening, sensitive data leakage protection, and AI/LLM safety across all services, endpoints, and agent integrations.

When to Use

Activate whenever writing authentication, authorization, session management, database queries, cryptography, external API integrations, user input handling, or agent tool calling.

Rules & Patterns

Negative Constraints (What NOT to Do)

1. NEVER use standard string comparison (===) for secrets/hashes: Always use crypto.timingSafeEqual to prevent timing attacks.
2. NEVER store sensitive JWT access/refresh tokens in localStorage: Store tokens in httpOnly, Secure, SameSite=Strict cookies.
3. NEVER return raw database/internal error messages or stack traces to the client: Return standardized generic error codes (INTERNAL_SERVER_ERROR) and log details internally.
4. NEVER trust client-provided IDs for authorization without tenant/ownership checks: Always verify where: { id, userId: session.userId } to prevent Broken Object Level Authorization (BOLA/IDOR).
5. NEVER disable CSRF protection, CORS allow-all (*), or TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0) in production: Always enforce strict origin whitelists and HTTPS.
6. NEVER pass un-sanitized third-party content directly into system prompts or shell execution: Treat all external data as potentially adversarial.

---

OWASP Top 10 for Modern APIs & Full-Stack

1. Injection (SQL, NoSQL, Command)

• Always use parameterized queries — never concatenate user input into SQL or shell commands.
• Use ORMs (Prisma, Drizzle, SQLAlchemy) with strict schema validation.
• Validate and sanitize all user input before processing.

2. Broken Object Level Authorization (BOLA / IDOR)

• Validate user ownership on EVERY database read, update, or delete:

  // [GOOD] Scoped to authenticated user
  const doc = await db.document.findFirst({
    where: { id: documentId, tenantId: session.tenantId }
  });