mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00

Files

T

Marius CiepluchandClaude Opus 4.8 6699f1f8f9 chore: add kiro spec-driven tooling and steering docs

Add the Kiro-style agentic SDLC tooling used to drive this project: the
.opencode/skills/kiro-* skill set (discovery, spec init/requirements/design/
tasks, validation, implementation, review, steering), the .kiro/settings
templates, and AGENTS.md describing the workflow. Update the spec docs
(assessment/design/requirements/tasks) to current state.

Scope tests/test_opencode_skills.py to the project's own openultrasast-*
skills so the third-party kiro-* tooling (which uses a different frontmatter
convention) no longer breaks the frontmatter check.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

2026-06-21 14:28:19 +02:00

2.0 KiB

Raw Permalink Blame History

Security Standards

[Purpose: define security posture with patterns for validation, authz, secrets, and data]

Philosophy

Defense in depth; least privilege; secure by default; fail closed
Validate at boundaries; sanitize for context; never trust input
Separate authentication (who) and authorization (what)

Input & Output

Validate at API boundaries and UI forms; enforce types and constraints
Sanitize/escape based on destination (HTML, SQL, shell, logs)
Prefer allow-lists over block-lists; reject early with minimal detail

Authentication & Authorization

Authentication: verify identity; issue short-lived tokens/sessions
Authorization: check permissions before actions; deny by default
Centralize policies; avoid duplicating checks across code

Pattern:

if (!user.hasPermission('resource:action')) throw ForbiddenError();

Secrets & Configuration

Never commit secrets; store in secret manager or env
Rotate regularly; audit access; scope minimal
Validate required env vars at startup; fail fast on missing

Sensitive Data

Minimize collection; mask/redact in logs; encrypt at rest and in transit
Restrict access by role/need-to-know; track access to sensitive records

Session/Token Security

httpOnly + secure cookies where possible; TLS everywhere
Short expiration; rotate on refresh; revoke on logout/compromise
Bind tokens to audience/issuer; include minimal claims

Logging (security-aware)

Log auth attempts, permission denials, and sensitive operations
Never log passwords, tokens, secrets, full PII; avoid full bodies
Include requestId and context to correlate events

Headers & Transport

Enforce TLS; HSTS
Set security headers (CSP, X-Frame-Options, X-Content-Type-Options)
Prefer modern crypto; disable weak protocols/ciphers

Vulnerability Posture

Prefer secure libraries; keep dependencies updated
Static/dynamic scans in CI; track and remediate
Educate team on common classes; encode as patterns above

Focus on patterns and principles. Link concrete configs to ops docs.

2.0 KiB Raw Permalink Blame History