---
description: Mandatory security checks for this SPA/Electron frontend
alwaysApply: true
---

# Security Guidelines

## Mandatory Security Checks

Before ANY commit:

- [ ] No hardcoded secrets (API keys, passwords, tokens)
- [ ] All user inputs validated (Zod + `@repo/ui/validators`)
- [ ] XSS prevention — React text nodes by default; never unsanitized `dangerouslySetInnerHTML`
- [ ] Auth tokens only via `src/core/lib/auth.helper` and the shared `apiClient` interceptors
- [ ] No secrets in client bundles; env files only under `apps/*/.env*`
- [ ] Error messages shown to users do not leak tokens or stack traces

This is a browser/Electron client. Do not invent SQL injection, CSRF-on-API-endpoints, or API rate-limiting checks here — those belong to the backend.

## Secret Management

```typescript
// NEVER: Hardcoded secrets
const apiKey = "sk-proj-xxxxx"

// ALWAYS: App env wrapper (apps/web)
import { ENV } from '../environment'

if (!ENV.API_BASE_URL) {
  throw new Error('VITE_API_BASE_URL is not configured')
}
```

- Env files: `apps/web/.env*` (see `apps/web/.env.example`). Never at monorepo root.
- Components read `ENV` from `src/core/environment`, not `import.meta.env` directly.
- `VITE_*` values are public to the client. Do not put private credentials in Vite env except documented local-dev CouchDB fields.

## Auth and storage

- HTTP: singleton `apiClient` from `src/core/lib/api-client` — never raw axios.
- Session teardown: `terminateAuthSession` in `auth.helper`.
- Do not store tokens in source. Do not log access tokens.

## Electron

When touching `apps/desktop/`: keep `contextIsolation: true`, `nodeIntegration: false`, `sandbox: true`. Do not expose Node APIs on `window` outside the existing preload bridge.

## Security Response Protocol

If a security issue is found:

1. STOP immediately
2. Use **security-reviewer** agent
3. Fix CRITICAL issues before continuing
4. Rotate any exposed secrets
5. Review the rest of the codebase for the same pattern