Security — Compliance & Protection
Assume breach. Defense in depth. Least privilege everywhere.
Step 0: Detect the Stack
Before advising on specific implementations, identify the project's stack (check package.json, go.mod, Gemfile, pyproject.toml, pom.xml, Cargo.toml). Security principles are universal — the libraries that implement them vary. Always recommend the idiomatic solution for the stack in use, not a JavaScript-specific one.
Security Defaults
Every project ships with:
| Control |
What to implement |
| Auth |
OAuth 2.0 / OIDC via the standard library for your stack |
| Sessions |
HTTP-only, Secure, SameSite=Strict cookies |
| Passwords |
bcrypt or argon2, min 12 chars, no max limit |
| API auth |
Bearer tokens with expiry, refresh token rotation |
| CORS |
Explicit allowlist, never * in production |
| HTTPS |
Everywhere. No exceptions. HSTS headers. |
| CSP |
Content-Security-Policy header on all pages |
| Rate limiting |
Auth endpoints: 5/min. API: 100/min. Adjust per use. |
OWASP Top 10 Quick Reference
| Vulnerability |
Prevention |
| Injection (SQL, NoSQL, OS) |
Parameterized queries, ORMs, never string concat |
| Broken Auth |
MFA, session timeouts, account lockout |
| Sensitive Data Exposure |
Encrypt at rest + transit, minimize data collection |
| XXE |
Disable external entity processing |
| Broken Access Control |
Check permissions server-side on every request |
| Security Misconfiguration |
Defaults off, hardened configs, no debug in prod |
| XSS |
Output encoding, CSP headers, sanitize HTML |
| Insecure Deserialization |
Validate and type-check all serialized data |
| Known Vulnerabilities |
Dependency audit tool for your stack (npm audit, pip audit, go mod tidy, bundle audit, etc.) + automated updates |
| Insufficient Logging |
Log auth events, access denied, input validation failures |
HIPAA Compliance (Health-Tech)
Required if handling PHI (Protected Health Information):
| Requirement |
Implementation |
| Encryption at rest |
AES-256 for databases and file storage |
| Encryption in transit |
TLS 1.2+ everywhere |
| Access controls |
Role-based, audit-logged, least privilege |
| Audit trail |
Every PHI access logged with who, what, when |
| BAA |
Business Associate Agreement with every vendor touching PHI |
| Data minimization |
Collect only what's clinically necessary |
| Breach notification |
60-day notification requirement — have a plan |
| Employee training |
Annual security awareness training |
PHI includes: Names, dates, phone numbers, emails, SSN, medical record numbers, device IDs, biometric data, photos, and any data that could identify a patient.
Vendor checklist:
- Does your cloud provider sign BAAs? (AWS, GCP, Azure: yes. Many others: no.)
- Does your analytics tool see PHI? If yes, need BAA or strip PHI first.
- Does your error tracking capture PHI in stack traces? Strip it.
SOC 2 Basics
| Trust Principle |
What to Implement |
| Security |
Access controls, encryption, firewalls, IDS |
| Availability |
Uptime monitoring, incident response, backups |
| Processing Integrity |
Input validation, error handling, QA |
| Confidentiality |
Encryption, access logging, data classification |
| Privacy |
Consent, data retention, deletion, privacy policy |
Start with: Security + Availability. Add others when customers require it.
Security Review Checklist
When reviewing code for security:
- Auth on every endpoint? — Not just the route, but the data query too
- Input validated at boundary? — Use the schema/validation library for your stack before any processing
- Secrets in env vars? — Never in code, git, or client bundles
- Queries parameterized? — No string concatenation, no interpolation into SQL or commands
- Error messages safe? — No stack traces, no internal paths to users
- Deps up to date? — Run your stack's dependency audit tool
- Logging sufficient? — Auth events, permission failures, anomalies
- Data minimized? — Only collecting what's needed, only retaining as long as required
1---2name: security3description: (forwward) Implements authentication, authorization, encryption, HIPAA compliance, SOC 2 controls, and security hardening with defense-in-depth defaults. Triggers on auth, encryption, compliance, penetration testing, privacy, or any security concern.4---56# Security — Compliance & Protection78Assume breach. Defense in depth. Least privilege everywhere.910## Step 0: Detect the Stack1112Before advising on specific implementations, identify the project's stack (check `package.json`, `go.mod`, `Gemfile`, `pyproject.toml`, `pom.xml`, `Cargo.toml`). Security principles are universal — the libraries that implement them vary. Always recommend the idiomatic solution for the stack in use, not a JavaScript-specific one.1314## Security Defaults1516Every project ships with:1718| Control | What to implement |19|---------|------------------|20| Auth | OAuth 2.0 / OIDC via the standard library for your stack |21| Sessions | HTTP-only, Secure, SameSite=Strict cookies |22| Passwords | bcrypt or argon2, min 12 chars, no max limit |23| API auth | Bearer tokens with expiry, refresh token rotation |24| CORS | Explicit allowlist, never `*` in production |25| HTTPS | Everywhere. No exceptions. HSTS headers. |26| CSP | Content-Security-Policy header on all pages |27| Rate limiting | Auth endpoints: 5/min. API: 100/min. Adjust per use. |2829## OWASP Top 10 Quick Reference3031| Vulnerability | Prevention |32|--------------|------------|33| Injection (SQL, NoSQL, OS) | Parameterized queries, ORMs, never string concat |34| Broken Auth | MFA, session timeouts, account lockout |35| Sensitive Data Exposure | Encrypt at rest + transit, minimize data collection |36| XXE | Disable external entity processing |37| Broken Access Control | Check permissions server-side on every request |38| Security Misconfiguration | Defaults off, hardened configs, no debug in prod |39| XSS | Output encoding, CSP headers, sanitize HTML |40| Insecure Deserialization | Validate and type-check all serialized data |41| Known Vulnerabilities | Dependency audit tool for your stack (`npm audit`, `pip audit`, `go mod tidy`, `bundle audit`, etc.) + automated updates |42| Insufficient Logging | Log auth events, access denied, input validation failures |4344## HIPAA Compliance (Health-Tech)4546**Required if handling PHI (Protected Health Information):**4748| Requirement | Implementation |49|-------------|---------------|50| Encryption at rest | AES-256 for databases and file storage |51| Encryption in transit | TLS 1.2+ everywhere |52| Access controls | Role-based, audit-logged, least privilege |53| Audit trail | Every PHI access logged with who, what, when |54| BAA | Business Associate Agreement with every vendor touching PHI |55| Data minimization | Collect only what's clinically necessary |56| Breach notification | 60-day notification requirement — have a plan |57| Employee training | Annual security awareness training |5859**PHI includes:** Names, dates, phone numbers, emails, SSN, medical record numbers, device IDs, biometric data, photos, and any data that could identify a patient.6061**Vendor checklist:**62- Does your cloud provider sign BAAs? (AWS, GCP, Azure: yes. Many others: no.)63- Does your analytics tool see PHI? If yes, need BAA or strip PHI first.64- Does your error tracking capture PHI in stack traces? Strip it.6566## SOC 2 Basics6768| Trust Principle | What to Implement |69|----------------|-------------------|70| Security | Access controls, encryption, firewalls, IDS |71| Availability | Uptime monitoring, incident response, backups |72| Processing Integrity | Input validation, error handling, QA |73| Confidentiality | Encryption, access logging, data classification |74| Privacy | Consent, data retention, deletion, privacy policy |7576**Start with:** Security + Availability. Add others when customers require it.7778## Security Review Checklist7980When reviewing code for security:81821. **Auth on every endpoint?** — Not just the route, but the data query too832. **Input validated at boundary?** — Use the schema/validation library for your stack before any processing843. **Secrets in env vars?** — Never in code, git, or client bundles854. **Queries parameterized?** — No string concatenation, no interpolation into SQL or commands865. **Error messages safe?** — No stack traces, no internal paths to users876. **Deps up to date?** — Run your stack's dependency audit tool887. **Logging sufficient?** — Auth events, permission failures, anomalies898. **Data minimized?** — Only collecting what's needed, only retaining as long as required
iankiku