Safety Guardrails
Git Safety
| Rule |
Why |
| Never force push to main/master |
Destroys team history, breaks CI |
Never git reset --hard without explicit confirmation |
Irreversible data loss |
| Never amend published commits |
Creates divergent history for collaborators |
Never skip pre-commit hooks (--no-verify) |
Hooks catch real issues |
| Stage specific files by name |
git add . risks committing secrets or binaries |
| Never commit .env, credentials, API keys |
Secrets in git history are permanent |
| Verify current branch before pushing |
Avoid pushing to wrong branch |
| Never force-push to someone else's branch |
Only to your own fork branches |
Destructive Commands
These commands need explicit user confirmation before running:
| Command |
Risk |
rm -rf |
Permanent file deletion |
git reset --hard |
Discards uncommitted changes |
git push --force |
Overwrites remote history |
git clean -fdx |
Deletes untracked files including gitignored |
DROP TABLE / TRUNCATE |
Irreversible data loss |
kill -9 on shared processes |
May corrupt state |
| Modifying CI/CD pipelines |
Visible to whole team |
Secrets and Credentials
Never Commit
.env files, .env.* (except .env.example)- API keys, access tokens, bearer tokens
- Passwords, connection strings with credentials
- Private keys (
.pem, .key, id_rsa)
- OAuth client secrets
- Cloud provider credentials (AWS, GCP, Azure)
Use Placeholders
.env.example with placeholder values is safe to commit:
DATABASE_URL=postgresql://user:password@localhost:5432/dbname
API_KEY=your-api-key-here
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
If Real Credentials Are in Git History
- Rotate the credential immediately -- git history is permanent and public
- Use
git filter-repo or BFG to remove from history
- Force-push cleaned history (coordinate with team)
- Audit access logs for suspicious use
Scan Before Committing
# Check staged changes for common secret patterns
git diff --cached | grep -iE 'api[_-]?key|secret|password|token|bearer' | grep -v example
# Tools
gitleaks detect --source=. --verbose
trufflehog git file://. --only-verified
Code Security Basics
| Rule |
Why |
| Validate user input at system boundaries |
Prevents injection attacks |
| Use parameterized queries, never string concat |
SQL injection |
| Sanitize data before rendering in templates |
XSS |
| Use bcrypt/argon2 for password hashing |
MD5/SHA are broken for passwords |
| Set CORS origins from env, never wildcard in prod |
Cross-origin attacks |
| HTTPS only, no mixed content |
MITM attacks |
| Rate-limit authentication endpoints |
Credential stuffing / brute force |
Dependency Safety
- Check vulnerabilities before adding new packages (
npm audit, pip-audit, cargo audit)
- Prefer well-maintained packages with active security response
- Pin dependency versions in lock files
- Review package permissions (scripts, post-install hooks)
- Watch for typosquatting:
reqeusts vs requests, expresss vs express
Working with Shared Systems
Actions that affect others need confirmation:
- Pushing code (affects CI, teammates)
- Creating/closing/commenting on PRs or issues
- Sending messages (Slack, email, GitHub)
- Modifying shared infrastructure
- Deploying to staging/production
Third-Party Uploads
Uploading content to external tools publishes it:
- Pastebins, gists, diagram renderers
- Cloud storage with sharable links
- AI chatbots (data may be retained/trained on)
Before uploading: is this content sensitive? PII, internal architecture, credentials?
Anti-Patterns
| Anti-Pattern |
Problem |
Do Instead |
git add . |
Accidentally stages secrets, binaries |
Stage specific files by name |
--no-verify to skip hooks |
Bypasses real safety checks |
Fix the hook failure, or ask why it's failing |
| Force push to shared branch |
Destroys teammates' work |
Rebase locally, only force-push your own branches |
| Committing secrets "just temporarily" |
Git history is permanent |
Never, always use .env.example |
| "It's just a test credential" |
Real bad actors scan GitHub |
Rotate and remove from history |
rm -rf based on LLM suggestion |
LLMs hallucinate paths |
Verify path manually, dry-run with ls first |
1---2name: guard3description: Use when making git operations, handling secrets, committing code, or dealing with credentials. Enforces git safety rules (no force-push to main, no amend of published commits), secret-handling discipline (never commit .env, use .env.example), and destructive-command caution.4---56# Safety Guardrails78## Git Safety910| Rule | Why |11|------|-----|12| Never force push to main/master | Destroys team history, breaks CI |13| Never `git reset --hard` without explicit confirmation | Irreversible data loss |14| Never amend published commits | Creates divergent history for collaborators |15| Never skip pre-commit hooks (`--no-verify`) | Hooks catch real issues |16| Stage specific files by name | `git add .` risks committing secrets or binaries |17| Never commit .env, credentials, API keys | Secrets in git history are permanent |18| Verify current branch before pushing | Avoid pushing to wrong branch |19| Never force-push to someone else's branch | Only to your own fork branches |2021## Destructive Commands2223These commands need explicit user confirmation before running:2425| Command | Risk |26|---------|------|27| `rm -rf` | Permanent file deletion |28| `git reset --hard` | Discards uncommitted changes |29| `git push --force` | Overwrites remote history |30| `git clean -fdx` | Deletes untracked files including gitignored |31| `DROP TABLE` / `TRUNCATE` | Irreversible data loss |32| `kill -9` on shared processes | May corrupt state |33| Modifying CI/CD pipelines | Visible to whole team |3435## Secrets and Credentials3637### Never Commit38- `.env` files, `.env.*` (except `.env.example`)39- API keys, access tokens, bearer tokens40- Passwords, connection strings with credentials41- Private keys (`.pem`, `.key`, `id_rsa`)42- OAuth client secrets43- Cloud provider credentials (AWS, GCP, Azure)4445### Use Placeholders46`.env.example` with placeholder values is safe to commit:47```bash48DATABASE_URL=postgresql://user:password@localhost:5432/dbname49API_KEY=your-api-key-here50AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE51```5253### If Real Credentials Are in Git History541. Rotate the credential immediately -- git history is permanent and public552. Use `git filter-repo` or BFG to remove from history563. Force-push cleaned history (coordinate with team)574. Audit access logs for suspicious use5859### Scan Before Committing60```bash61# Check staged changes for common secret patterns62git diff --cached | grep -iE 'api[_-]?key|secret|password|token|bearer' | grep -v example6364# Tools65gitleaks detect --source=. --verbose66trufflehog git file://. --only-verified67```6869## Code Security Basics7071| Rule | Why |72|------|-----|73| Validate user input at system boundaries | Prevents injection attacks |74| Use parameterized queries, never string concat | SQL injection |75| Sanitize data before rendering in templates | XSS |76| Use bcrypt/argon2 for password hashing | MD5/SHA are broken for passwords |77| Set CORS origins from env, never wildcard in prod | Cross-origin attacks |78| HTTPS only, no mixed content | MITM attacks |79| Rate-limit authentication endpoints | Credential stuffing / brute force |8081## Dependency Safety8283- Check vulnerabilities before adding new packages (`npm audit`, `pip-audit`, `cargo audit`)84- Prefer well-maintained packages with active security response85- Pin dependency versions in lock files86- Review package permissions (scripts, post-install hooks)87- Watch for typosquatting: `reqeusts` vs `requests`, `expresss` vs `express`8889## Working with Shared Systems9091Actions that affect others need confirmation:92- Pushing code (affects CI, teammates)93- Creating/closing/commenting on PRs or issues94- Sending messages (Slack, email, GitHub)95- Modifying shared infrastructure96- Deploying to staging/production9798## Third-Party Uploads99100Uploading content to external tools publishes it:101- Pastebins, gists, diagram renderers102- Cloud storage with sharable links103- AI chatbots (data may be retained/trained on)104105Before uploading: is this content sensitive? PII, internal architecture, credentials?106107## Anti-Patterns108109| Anti-Pattern | Problem | Do Instead |110|-------------|---------|-----------|111| `git add .` | Accidentally stages secrets, binaries | Stage specific files by name |112| `--no-verify` to skip hooks | Bypasses real safety checks | Fix the hook failure, or ask why it's failing |113| Force push to shared branch | Destroys teammates' work | Rebase locally, only force-push your own branches |114| Committing secrets "just temporarily" | Git history is permanent | Never, always use .env.example |115| "It's just a test credential" | Real bad actors scan GitHub | Rotate and remove from history |116| `rm -rf` based on LLM suggestion | LLMs hallucinate paths | Verify path manually, dry-run with `ls` first |
Sagargupta16