patrickandClaude Sonnet 5
4a19335a1e
Replace Next.js/Supabase/Vercel stack with a self-hostable setup: Vite+React frontend, Fastify+Drizzle+PostgreSQL backend with own JWT auth, deploy via git pull + rsync + systemd (checkout/service separated, updates pulled from Gitea). Adds a reference auth route (register/login/me) as the canonical pattern for new routes. Updates all skills/rules/agents/docs to match. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BMdBJfD9TT6XUU2NqGG1PN
36 lines
1.4 KiB
Markdown
36 lines
1.4 KiB
Markdown
---
|
|
paths:
|
|
- "backend/src/**"
|
|
- ".env*"
|
|
- "backend/drizzle.config.ts"
|
|
---
|
|
|
|
# Security Rules
|
|
|
|
## Secrets Management
|
|
- NEVER commit secrets, API keys, or credentials to git
|
|
- Use `.env` for local/server config (already in `.gitignore`), document required vars in `.env.example` with dummy values
|
|
- Frontend env vars must be explicitly prefixed `VITE_` and contain nothing secret — anything with that prefix ships to the browser
|
|
|
|
## Input Validation
|
|
- Validate ALL user input on the server side with Zod
|
|
- Never trust client-side validation alone
|
|
- Sanitize data before database insertion
|
|
|
|
## Authentication
|
|
- Always verify the JWT (`request.jwtVerify()`) before processing protected API requests
|
|
- Authorization/ownership checks live in route handlers — there is no database-level RLS backstop, so don't skip them
|
|
- Implement rate limiting on authentication endpoints (`@fastify/rate-limit`, tighter limits on `/api/auth/**`)
|
|
|
|
## Security Headers
|
|
- X-Frame-Options: DENY
|
|
- X-Content-Type-Options: nosniff
|
|
- Referrer-Policy: origin-when-cross-origin
|
|
- Strict-Transport-Security with includeSubDomains
|
|
- Set via `@fastify/helmet` on the backend, or nginx `add_header` directives at the reverse proxy
|
|
|
|
## Code Review Triggers
|
|
- Any changes to authentication flow require explicit user approval
|
|
- Any changes to database migrations require explicit user approval before running `db:migrate` against a server
|
|
- Any new environment variables must be documented in `.env.example`
|