---
paths:
  - "backend/src/**"
  - ".env*"
  - "backend/drizzle.config.ts"
---

# Security Rules

## Secrets Management
- NEVER commit secrets, API keys, or credentials to git
- Use `.env` for local/server config (already in `.gitignore`), document required vars in `.env.example` with dummy values
- Frontend env vars must be explicitly prefixed `VITE_` and contain nothing secret — anything with that prefix ships to the browser

## Input Validation
- Validate ALL user input on the server side with Zod
- Never trust client-side validation alone
- Sanitize data before database insertion

## Authentication
- Always verify the JWT (`request.jwtVerify()`) before processing protected API requests
- Authorization/ownership checks live in route handlers — there is no database-level RLS backstop, so don't skip them
- Implement rate limiting on authentication endpoints (`@fastify/rate-limit`, tighter limits on `/api/auth/**`)

## Security Headers
- X-Frame-Options: DENY
- X-Content-Type-Options: nosniff
- Referrer-Policy: origin-when-cross-origin
- Strict-Transport-Security with includeSubDomains
- Set via `@fastify/helmet` on the backend, or nginx `add_header` directives at the reverse proxy

## Code Review Triggers
- Any changes to authentication flow require explicit user approval
- Any changes to database migrations require explicit user approval before running `db:migrate` against a server
- Any new environment variables must be documented in `.env.example`