shancheas
ff6814d038
- Introduced coding standards for TypeScript and React in SKILL.md. - Added continuous learning skill with configuration and evaluation scripts. - Created detail layout guidelines for read-only pages. - Established form layout rules for data-entry forms. - Documented project guidelines for the frontend monorepo. - Implemented security review checklist for frontend/Electron applications. - Developed a verification loop skill for comprehensive session checks. This commit enhances the skill set available for developers, ensuring adherence to best practices and improving code quality.
58 lines
2.0 KiB
Plaintext
58 lines
2.0 KiB
Plaintext
---
|
|
description: Mandatory security checks for this SPA/Electron frontend
|
|
alwaysApply: true
|
|
---
|
|
|
|
# Security Guidelines
|
|
|
|
## Mandatory Security Checks
|
|
|
|
Before ANY commit:
|
|
|
|
- [ ] No hardcoded secrets (API keys, passwords, tokens)
|
|
- [ ] All user inputs validated (Zod + `@repo/ui/validators`)
|
|
- [ ] XSS prevention — React text nodes by default; never unsanitized `dangerouslySetInnerHTML`
|
|
- [ ] Auth tokens only via `src/core/lib/auth.helper` and the shared `apiClient` interceptors
|
|
- [ ] No secrets in client bundles; env files only under `apps/*/.env*`
|
|
- [ ] Error messages shown to users do not leak tokens or stack traces
|
|
|
|
This is a browser/Electron client. Do not invent SQL injection, CSRF-on-API-endpoints, or API rate-limiting checks here — those belong to the backend.
|
|
|
|
## Secret Management
|
|
|
|
```typescript
|
|
// NEVER: Hardcoded secrets
|
|
const apiKey = "sk-proj-xxxxx"
|
|
|
|
// ALWAYS: App env wrapper (apps/web)
|
|
import { ENV } from '../environment'
|
|
|
|
if (!ENV.API_BASE_URL) {
|
|
throw new Error('VITE_API_BASE_URL is not configured')
|
|
}
|
|
```
|
|
|
|
- Env files: `apps/web/.env*` (see `apps/web/.env.example`). Never at monorepo root.
|
|
- Components read `ENV` from `src/core/environment`, not `import.meta.env` directly.
|
|
- `VITE_*` values are public to the client. Do not put private credentials in Vite env except documented local-dev CouchDB fields.
|
|
|
|
## Auth and storage
|
|
|
|
- HTTP: singleton `apiClient` from `src/core/lib/api-client` — never raw axios.
|
|
- Session teardown: `terminateAuthSession` in `auth.helper`.
|
|
- Do not store tokens in source. Do not log access tokens.
|
|
|
|
## Electron
|
|
|
|
When touching `apps/desktop/`: keep `contextIsolation: true`, `nodeIntegration: false`, `sandbox: true`. Do not expose Node APIs on `window` outside the existing preload bridge.
|
|
|
|
## Security Response Protocol
|
|
|
|
If a security issue is found:
|
|
|
|
1. STOP immediately
|
|
2. Use **security-reviewer** agent
|
|
3. Fix CRITICAL issues before continuing
|
|
4. Rotate any exposed secrets
|
|
5. Review the rest of the codebase for the same pattern
|