Secure Coding Rules

Secure Coding Rules

A CLAUDE.md/AGENTS.md-style rules set covering secrets handling, input validation, injection prevention, authorization, dependency hygiene, and PII logging. Unlike a workflow, this doesn't run as a procedure — it's loaded as standing rules the agent follows on every edit for the life of the project.

When to use

• Load into any project as baseline rules, especially ones handling user data, auth, or payments.
• Pair with pr-reviewer — these rules constrain how code is written; the reviewer checklist catches what slips through.
• Good as an always-on rules file (.claude/rules/, a CLAUDE.md include, a Cursor rule) rather than something invoked per-task.

Install

npx openagents-cli add openagents/secure-coding-rules

For claude-code/cursor, consider also referencing RULES.md directly from your project's own CLAUDE.md/rules file (e.g. @.claude/skills/secure-coding-rules/RULES.md) so it's always in context rather than only when explicitly invoked.

Inputs

None — this package has no runtime parameters. It's a static rules file.

Example run

The agent applies the rules while writing the endpoint: parameterized queries, resource-level authorization on the transfer target, input validation on amount/ currency, no logging of account numbers, and no secrets in the diff.

Files

• RULES.md — the rules themselves (entry point): secrets, input validation, injection prevention, authz/authn, dependency hygiene, logging/PII.
• checklists/owasp-quick.md — a fast pre-ship pass mapped to the OWASP Top 10.

Limitations

• Rules, not enforcement — nothing here runs a scanner or blocks a commit; pair with static analysis / secret-scanning tooling in CI for automated enforcement.
• Written to be language/framework-agnostic; teams with a specific stack (e.g. a particular ORM) may want to extend it with stack-specific examples.
• Not a substitute for a real security review on high-risk changes (auth redesigns, crypto, payment flows).