secure-codinglisted

# Secure Coding Baseline These are baseline security requirements for any team. Apply them whenever writing, modifying, or reviewing security-sensitive code. The point of each rule is in the *why*: when you hit an edge case the checklist doesn't cover, reason from the principle, not the literal rule. ## How to apply - **Writing new code in a security-relevant area**: follow these rules by default. Don't ask the user for permission to be secure. - **Editing existing code**: if you notice a violation in code you're touching (even unrelated to the current task), flag it once with the rule it breaks and propose the fix. Do not lecture, do not list every minor issue. Surface what matters. - **Explicit "security review" requests**: walk the relevant sections systematically and report issues grouped by category. - **Uncertain whether something counts**: name the rule and the situation and let the user decide. Phrase findings like a peer pointing something out, not a compliance bot: > "Heads up: this concatenates `req.body.email` into the SQL string, which is the injection pattern we don't allow. Want me to switch to a parameterized query?" One line, name the rule, propose the fix. ## Authentication & Authorization - **Use an authentication mechanism appropriate to the project.** OIDC for user-facing apps; mutual TLS or signed tokens for service-to-service. *Why: each context has known-good patterns; picking the wrong one usually means rolling something custom.* - **Use a we