ai-coding-starter-kit-v2/.claude/rules/security.md

paths

paths
backend/src/** .env* backend/drizzle.config.ts

Security Rules

Secrets Management

• NEVER commit secrets, API keys, or credentials to git
• Use .env for local/server config (already in .gitignore), document required vars in .env.example with dummy values
• Frontend env vars must be explicitly prefixed VITE_ and contain nothing secret — anything with that prefix ships to the browser

Input Validation

• Validate ALL user input on the server side with Zod
• Never trust client-side validation alone
• Sanitize data before database insertion

Authentication

• Always verify the JWT (request.jwtVerify()) before processing protected API requests
• Authorization/ownership checks live in route handlers — there is no database-level RLS backstop, so don't skip them
• Implement rate limiting on authentication endpoints (@fastify/rate-limit, tighter limits on /api/auth/**)

Security Headers

• X-Frame-Options: DENY
• X-Content-Type-Options: nosniff
• Referrer-Policy: origin-when-cross-origin
• Strict-Transport-Security with includeSubDomains
• Set via @fastify/helmet on the backend, or nginx add_header directives at the reverse proxy

Code Review Triggers

• Any changes to authentication flow require explicit user approval
• Any changes to database migrations require explicit user approval before running db:migrate against a server
• Any new environment variables must be documented in .env.example