Security Rule
rule_id: R-SEC-01 category: Security status: locked owner: Project Manager / Architect / Security scope: auth, authorization, I/O, secrets, audit, dependencies, data security
1. Rule
Security-sensitive changes block release unless they are documented, testable, and reviewable.
2. Hard Rules
- Do not commit secrets, tokens, passwords, certificates, or private keys.
- Validate all external input.
- Use TLS for sensitive data in transit.
- Enforce authorization server-side.
- Audit sensitive operations.
- Production data export, repair, or backfill requires approval and masking policy.
3. Checklist
| Area | Requirement | Evidence |
|---|---|---|
| authn | login, token, session strategy defined | tests + review |
| authz | RBAC/ABAC/ACL or equivalent defined | permission matrix tests |
| input | params, files, callbacks validated | tests + scan |
| output | XSS protection and sensitive-field masking | E2E + review |
| data | encryption, backup, retention defined | architecture review |
| dependencies | no critical vulnerabilities | SCA scan |
| audit | actor, time, object, result traceable | logs / DB evidence |
4. Approval Required
Security or PM / Architect approval is required for:
- authn/authz model
- secrets, certificates, token lifecycle
- audit fields or audit storage
- encryption, masking, retention
- production data repair or export
5. Forbidden
- frontend-only authorization checks
- logging secrets, tokens, identity numbers, bank cards, or sensitive personal data
- releasing with unresolved critical security findings