security-policy

Files (1)

• SKILL.md

SKILL.md (first lines)

<!-- TEMPLATE. Replace every <...> with your organisation's actual policy text, keep it short, and name the owner.
     Source of truth: <link to security policy / ISMS control>   Owner: <CISO delegate>   Last reviewed: <YYYY-MM-DD> -->
# Security policy (applied while the work is done)

## Data classification
- Data classes: <public | internal | confidential | restricted>. PII and payment data are <restricted>.
- Restricted data never appears in logs, error messages, analytics events, screenshots or test fixtures.
- New storage or transfer of restricted data requires a flagged concern in spec.md for <data protection owner>.

## Authentication and authorisation
- Every external-facing endpoint uses <the gateway / IdP>; no new authentication mechanisms.
- Authorisation checks live <server-side, in the domain layer>; never only in the UI.
- Service-to-service calls use <short-lived workload identity>; no shared static credentials.

## Secrets and configuration
- Secrets come from <the secret store>; never from files in the repo, CI logs or chat.
- `.env*`, `secrets/`, keys and certificates are never written by an agent (enforced by the `secrets-guard` hook).

## Dependencies and supply chain
- New third-party dependencies require <license check + vulnerability scan>; pinned versions; <platform team> owns bumps.
- Generated code is regenerated, never hand-edited (enforced by `protectedPaths`).

## Network and infrastructure
- No new public endpoints or egress destinations without a flagged concern for <network security owner>.
- Infrastructure and migration changes need a change ticket referenced in the PR (enforced by `protectedPaths`).

## How to apply
- In spec.md: add a **Flagged concern** row for every conflict; name the owner; do not resolve it yourself.
- In plan.md: list the security tests that prove the controls (403 paths, schema rejection, log redaction).
- In review: findings that breach this policy are **Important**.

From bibutikoley/ai-sdlc-claude, MIT.

More from bibutikoley/ai-sdlc-claude