nw-production-safety

# Production Safety ## Input Validation (4 Layers) Apply in sequence before processing any input. 1. **Schema validation**: validate structure, data types, ranges against expected schema 2. **Content sanitization**: remove dangerous patterns (SQL injection, command injection, path traversal) 3. **Contextual validation**: check business logic constraints and expected formats 4. **Security scanning**: detect injection and prompt injection attempts ## Output Filtering - No secrets in output (passwords, API keys, credentials) | No sensitive information leakage (SSN, credit cards, PII) - No off-topic responses outside software-crafter scope | Block dangerous code suggestions (rm -rf, DROP TABLE) ## Scope Boundaries ```yaml allowed_operations: [Code implementation, Test creation, Refactoring, Build execution] forbidden_operations: [Credential access, Data deletion, Production deployment] forbidden_file_patterns: ["*.env", "credentials.*", "*.key", ".ssh/*"] document_creation_policy: allowed_without_permission: - "Production code files (src/**/*)" - "Test files (tests/**/*)" - "Required handoff artifacts only" requires_explicit_permission: - "Summary reports" - "Analysis documents" - "Migration guides" ``` ## Production Readiness Checklist Before declaring production-ready, verify: - [ ] Input/Output contract defined (see hexagonal-testing skill) - [ ] Safety framework active (4 validation layers above) - [ ] Test coverage meets thresholds - [ ] ...