“alexvisualmakers”
600552c858
Replace the manual "read .claude/agents/*.md" workflow with native Claude Code features for a more efficient, scalable development experience: - **Skills** (.claude/skills/): 7 auto-discovered slash commands (/requirements, /architecture, /frontend, /backend, /qa, /deploy, /help) with forked sub-agents for heavy tasks and inline execution for interactive ones - **Rules** (.claude/rules/): 4 modular rule files (general, frontend, backend, security) auto-applied based on file context - **Sub-Agents** (.claude/agents/): Lightweight configs for frontend-dev, backend-dev, and qa-engineer with model, tool, and turn limit settings - **Context Engineering**: Layered context loading, context isolation via forked skills, built-in context recovery after compaction, and "always read, never guess" rules to prevent hallucinated code references - **CLAUDE.md**: Auto-loaded project context replacing PROJECT_CONTEXT.md - **Feature tracking**: features/INDEX.md as persistent state across sessions - **Production guides**: docs/production/ for error tracking, security, performance, database optimization, and rate limiting - **Init Mode**: /requirements detects empty PRD and bootstraps full project setup (PRD + all feature specs) from a single project description Removed: 6 monolithic agent files, PROJECT_CONTEXT.md, HOW_TO_USE_AGENTS.md, TEMPLATE_CHANGELOG.md Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
29 lines
1.0 KiB
Markdown
29 lines
1.0 KiB
Markdown
# Security Rules
|
|
|
|
## Secrets Management
|
|
- NEVER commit secrets, API keys, or credentials to git
|
|
- Use `.env.local` for local development (already in .gitignore)
|
|
- Use `NEXT_PUBLIC_` prefix ONLY for values safe to expose in browser
|
|
- Document all required env vars in `.env.local.example` with dummy values
|
|
|
|
## Input Validation
|
|
- Validate ALL user input on the server side with Zod
|
|
- Never trust client-side validation alone
|
|
- Sanitize data before database insertion
|
|
|
|
## Authentication
|
|
- Always verify authentication before processing API requests
|
|
- Use Supabase RLS as a second line of defense
|
|
- Implement rate limiting on authentication endpoints
|
|
|
|
## Security Headers
|
|
- X-Frame-Options: DENY
|
|
- X-Content-Type-Options: nosniff
|
|
- Referrer-Policy: origin-when-cross-origin
|
|
- Strict-Transport-Security with includeSubDomains
|
|
|
|
## Code Review Triggers
|
|
- Any changes to RLS policies require explicit user approval
|
|
- Any changes to authentication flow require explicit user approval
|
|
- Any new environment variables must be documented in .env.local.example
|