---
description: Security, performance, and code quality standards for Compozy development including linter rules, security requirements, and performance guidelines
globs:
  - "**/*.go"
  - "**/Makefile"
  - "**/*.yml"
  - "**/*.yaml"
alwaysApply: true
---
# Quality and Security Standards

## Security

<security_requirements type="critical">
- **NEVER commit API keys or secrets** - use environment variables
- **NEVER expose secrets in logs** - use structured logging without sensitive data
- **Handle redaction markers:** `[REDACTED:amp-token]` indicates removed secrets - do not overwrite with markers
- Use the gosec linter to identify security issues
- Validate all inputs, especially those from external sources
- Follow secure coding practices for authentication and authorization
</security_requirements>

## Performance

<performance_guidelines>
- Minimize allocations in hot paths
- Consider resource usage and efficiency
</performance_guidelines>

## Specific Linter Rules to Follow

<linter_rules type="mandatory">
- **bodyclose**: Always close HTTP response bodies
- **errcheck**: Check error returns from all function calls
- **goconst**: Extract repeated string literals into constants
- **gocritic**: Follow idiomatic Go practices
- **staticcheck**: Address all static analysis warnings
- **unused**: Remove unused code
- **whitespace**: Maintain consistent whitespace
</linter_rules>