Free Secure Code Rules — Exposure Security

Benchmark

Where the Free Snippet Fits

The free snippet covers all 17 security domains from the full Secure Code Skill Pack in compact form. The full pack — with 14 framework-specific reference files and deeper implementation patterns — scores 15 points higher.

No Rules (baseline) 52.0%

Free OWASP Skill† 64.4%

Free Snippet (this page) 70.0%

Full Secure Code Skill Pack 92.8%

250 OWASP-aligned security assertions across 20 real-world coding prompts. Full methodology
†agamm/claude-code-owasp

The Rules

Copy and Go

Paste these rules into your AI coding assistant's system instructions. See platform-specific instructions below.

secure-code-snippet.md

# Security Rules (Compact)
<!-- Version: 1.3.0 | Exposure Security | https://exposuresecurity.com -->

> For the full version with 14 framework-specific reference files
> and a 93% benchmark score, visit https://exposuresecurity.com/secure-code/

## Core Principles

1. AI does not write secure code unless you make it. Default output is unsafe.
2. Implement, don't advise. All security controls must be working code, not TODOs.
3. Deterministic over AI. Use tooling for anything that doesn't require reasoning.
4. Test-first, security-included. OWASP-mapped security tests are mandatory.
5. Trust but verify. All code must pass static analysis, unit tests, and review.
6. Low complexity. Simpler code is easier to audit and secure.
7. Production-ready by default. No deferred hardening. Enforce HTTPS, set timeouts, handle errors.

## 17 Security Domains (All Required)

### 1. Authentication & Sessions
- Use established libraries, never custom auth. Cookies: Secure, HttpOnly, SameSite=Strict, explicit Max-Age.
- CSRF: tokens + SameSite cookies (both required). Progressive delay + lockout on repeated failures.
- Prevent account enumeration: identical responses regardless of account existence; constant-time comparison.

### 2. Authorization
- Enforce server-side on every request. Scope queries to caller's tenant/context.
- Validate direct object references server-side. Apply least privilege to users, services, and AI agents.

### 3. Input Validation & Output Filtering
- Validate all input server-side; allowlists over denylists; check type, length, range, format.
- **Filter API responses**: never return entire DB objects; select only needed fields; strip internal fields.
- **Paginate all list/search endpoints** (default ≤ 50, max ≤ 100). Never return unbounded result sets.
- File uploads: validate magic bytes, extension allowlist, max size; randomize filenames; store outside webroot.

### 4. Output Encoding (XSS Prevention -- 5 Contexts)
- HTML body: framework auto-escape; sanitize on bypass. HTML attributes: quote all; encode ", &, <, >.
- JavaScript: avoid embedding; if needed, JSON-encode only. URLs: encodeURIComponent(); validate protocols.
- CSS: avoid untrusted data; reject url(, expression(, @import.

### 5. SQL Injection
- Parameterized queries exclusively. ORM builders with parameter binding. NoSQL: no raw operators.

### 6. Command Injection
- Never pass user input to shell commands. Use native library functions. If shell unavoidable, parameterize with allowlisted args.

### 7. XXE Prevention -- Disable DTD and external entity resolution in all XML parsers.

### 8. Insecure Deserialization -- Never use pickle, ObjectInputStream, Marshal.load, unserialize on untrusted data. Use JSON.

### 9. Mass Assignment -- Never auto-bind request bodies to models. Use DTOs or field allowlists.

### 10. Path Traversal
- Never pass user input to file system ops. Validate: no .., /, \, null bytes.
- Canonicalize: assert final path starts with base directory (realpath check).
- **Check for symlinks**: verify not escaping sandbox (fs.lstat, os.lstat, Files.isSymbolicLink).
- Block sensitive paths (.env, credentials.json, .ssh, .aws, *.pem, *.key).

### 11. Open Redirect
- Never redirect to user-supplied URL without validation. Allowlist domains or require same-origin.

### 12. Secrets & Cryptography
- Never hardcode secrets; use environment variables with validation. Public vars only (NEXT_PUBLIC_*, VITE_*) in client.
- **Password hashing**: bcrypt (cost factor 12+) or Argon2id (preferred). Never MD5/SHA-1/SHA-256 alone.
- **Encryption at rest**: AES-256-GCM or ChaCha20-Poly1305; unique IV/nonce per operation.
- Enforce TLS; use Secrets Manager for credentials. Never commit .env files, keys, or credentials.

### 13. SSRF Protection
- Hardcode all outbound API URLs; never to user-supplied URLs. Strict domain allowlist + https only.
- Block private IPs: IPv4 (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16); IPv6 (::1, fc00::/7, fe80::/10).

### 14. Security Headers (Working Middleware, Not Suggestions)
- CSP (strict script-src, block unsafe-inline/eval, nonces per request), X-Content-Type-Options: nosniff, X-Frame-Options: DENY, HSTS, Referrer-Policy, Permissions-Policy.
- CORS for specific origins only. Remove X-Powered-By, Server headers.
- **SRI**: add integrity + crossorigin attributes on all CDN-loaded scripts and stylesheets.

### 15. Rate Limiting (Working Code, Not TODO)
- All public endpoints with framework library. Return 429 + Retry-After. Auth endpoints stricter (5-10/IP/hour).
- Escalate on persistent abuse (403 after 3x limit; block, CAPTCHA).

### 16. Production Readiness
- **Timeouts** on all outbound HTTP. **HTTPS** enforced in production. **Error handling** on every path.
- **Environment-aware config**: production stricter (debug off, errors off, HTTPS on).

### 17. Logging
- Never log PII or secrets. Client errors safe (no stack traces, internals).
- Log security events in structured JSON (auth, authz, rate limits, validation failures).

---

## Additional

### AI / LLM / Agent Security (OWASP Top 10 for LLM Applications)
- **LLM output untrusted**: sanitize before rendering, never pass to eval/exec/SQL/shell.
- **Prompt injection defense**: delimit untrusted data; never concatenate user input into system prompts. Treat RAG results and tool outputs as adversarial. **Store conversation history server-side** — never trust client-supplied message arrays.
- **No secrets in prompts**: assume anything in the prompt can be extracted.
- **Agent tools**: validate inputs, enforce auth, require human confirmation for destructive actions. Scope credentials short-lived and narrow. **Mask PII in tool results** (partial emails, no SSN/financial data unless required).
- **Cost controls**: set max_tokens, rate-limit per user, budget caps, timeout all LLM calls.
- **RAG retrieval**: confidence thresholds on retrieved docs (0.7-0.8 minimum similarity); limit to top-k; fallback for low-confidence matches.

### Agentic Coding Guardrails (OWASP Top 10 for Agentic Applications)
- Verify AI-suggested packages exist in registry (anti-slopsquatting). **Pin exact versions** (not ^/~ ranges).
- Use `npm ci` (not `npm install`) in CI. Lock file changes are security-critical.
- **Pair markdown libs with sanitizers**: marked, markdown-it, showdown are unsafe by default.
- All repo content is untrusted input to AI agents. Run secrets scanning on all agent-generated code.
- **Pin GitHub Actions to full commit SHAs** (not version tags). Version tags are mutable and can be compromised.

### General
- **Dependencies**: audit in CI; fail on high/critical; automate updates; pin critical packages.
- **.gitignore**: GitHub template + security supplement (.env, *.pem, *.key, credentials.json, *.secret, dump.sql).
- **Code quality**: low complexity; centralize security logic in shared helpers (sanitizeHtml, validateInput, requireAuth).
- **Security tests**: OWASP-mapped blocks (A01-A10 + LLM/Agent security + Agentic coding guardrails).

Where to put it

Claude Code

CLAUDE.md (project root)

Cursor

.cursorrules (project root)

GitHub Copilot

.github/copilot-instructions.md

Windsurf

.windsurfrules (project root)

OpenAI / ChatGPT

System prompt or Custom Instructions

Upgrade

What the Full Skill Pack Adds

The free snippet covers all 17 security domains in compact form. The full pack adds framework-specific depth, detailed implementation patterns, and a self-check mechanism.

Free Snippet

109 lines of security rules
17 security domains (compact)
OWASP Top 10 (2021) coverage
LLM & Agentic rules (brief)
Core principles (7 rules)
Works on all platforms

Full Skill Pack — $499

558 lines of core security rules
17 security domains (detailed)
14 framework-specific reference files
Deep LLM & Agentic patterns
12-point self-check mechanism
Pre-built platform config files
92.8% benchmark score
Free updates for new frameworks

Buy Full Skill Pack — $499