security-patterns

Security Patterns - Kailash SDK

Mandatory security patterns for all Kailash SDK development. These patterns prevent common vulnerabilities and ensure secure application development.

Overview

Security patterns cover:

• Secret management (no hardcoded credentials)
• Input validation (prevent injection attacks)
• Authentication and authorization
• OWASP Top 10 prevention
• Secure API design
• Environment variable handling

Critical Rules

1. NEVER Hardcode Secrets

# ❌ WRONG - Hardcoded credentials
api_key = "sk-1234567890abcdef"
db_password = "mypassword123"

# ✅ CORRECT - Environment variables
import os
api_key = os.environ["API_KEY"]
db_password = os.environ["DATABASE_PASSWORD"]

2. Validate All User Inputs

# ❌ WRONG - No validation
def process_user_input(user_data):
    return db.execute(f"SELECT * FROM users WHERE id = {user_data}")

# ✅ CORRECT - Parameterized queries (via DataFlow)
workflow.add_node("User_Read", "read_user", {
    "id": validated_user_id  # DataFlow handles parameterization
})

3. Use HTTPS for API Calls

# ❌ WRONG - HTTP in production
workflow.add_node("HTTPRequestNode", "api", {
    "url": "http://api.example.com/data"  # Insecure!
})

# ✅ CORRECT - HTTPS always
workflow.add_node("HTTPRequestNode", "api", {
    "url": "https://api.example.com/data"
})

Reference Documentation

Each entry below is a depth file that ships alongside this skill. Regenerated from the directory contents — the previous index listed eight security-*.md files that exist nowhere in the corpus, so every lookup dead-ended.

Credentials & Secrets

• credential-decode-helpers - One shared userinfo decoder; null-byte rejection after percent-decoding
• credential-url-handling - Canonical connection-string credential pipeline (py)

Input Handling & Injection

• sanitizer-contract - Display hygiene: token-replace sentinels, type-confusion raises
• path-containment - Resolve and normalize both candidate and root before the trust decision