ilia
f0e989b6b2
Cherry-pick TDD, app security checklist, and AgentShield scan guidance into our Cursor pack without installing the full ECC harness.
53 lines
1.8 KiB
Markdown
53 lines
1.8 KiB
Markdown
---
|
||
name: app-security-checklist
|
||
description: >-
|
||
Application security checklist when adding auth, APIs, user input, uploads,
|
||
payments, or handling secrets. Use for security review of app code (not the
|
||
Cursor /review-security subagent launcher).
|
||
metadata:
|
||
origin: ECC security-review cherry-pick (lean)
|
||
imported: "2026-07-29"
|
||
---
|
||
|
||
# App security checklist (lean)
|
||
|
||
Use when implementing or reviewing auth, APIs, uploads, secrets, or sensitive data.
|
||
For Cursor’s built-in branch security review subagent, use `/review-security` instead.
|
||
|
||
## Secrets
|
||
|
||
- No hardcoded keys/tokens/passwords in source
|
||
- App secrets → Infisical (`/apps/<repo>`); infra → Ansible Vault
|
||
- Local `.env` gitignored; commit `*.example` only
|
||
- Never log secrets, full tokens, card numbers, or passwords
|
||
|
||
## Input & data
|
||
|
||
- Validate/parse untrusted input (schema libs OK: zod, pydantic, etc.)
|
||
- Parameterized queries / ORM only — no string-concat SQL
|
||
- Uploads: size + type/extension allowlist; store outside web root when possible
|
||
- Sanitize any user HTML; prefer framework auto-escaping
|
||
|
||
## AuthZ
|
||
|
||
- Check authorization on every sensitive action (not only at login)
|
||
- Prefer httpOnly + Secure + SameSite cookies over localStorage tokens
|
||
- Generic client errors; detail only in server logs
|
||
|
||
## HTTP / abuse
|
||
|
||
- Rate-limit auth and expensive endpoints
|
||
- CSRF protection on cookie-session state changes
|
||
- Sensible security headers (CSP without casual `unsafe-inline`/`unsafe-eval`)
|
||
- CORS allowlist — not `*` with credentials
|
||
|
||
## Dependencies
|
||
|
||
- Lockfiles committed; CI uses reproducible install (`npm ci` / equivalent)
|
||
- Do not silence audit/lint gates with `|| true`
|
||
|
||
## Pre-ship gate (short)
|
||
|
||
Secrets out of git · inputs validated · queries parameterized · authZ on
|
||
mutations · no secret logging · rate limits on hot paths · CI gates honest.
|