---
description: EEIK Security Rules — apply to all files
globs: ["**/*"]
alwaysApply: true
---
<!-- Generated by EEIK generate_adapters.py on 2026-08-10 — do not edit by hand -->

## Security Non-Negotiables

- NEVER hardcode credentials, API keys, passwords, or AWS account IDs
- ALL secrets go to AWS Secrets Manager / environment variables
- NEVER log sensitive data (PII, tokens, passwords)
- SQL must use parameterised queries only — never string concatenation
- Input validation on ALL public API endpoints
- Dependency versions must be explicit — no `latest` or `*`

## OWASP Top 10 Checklist

Before any PR touching auth, data access, or external input:
- [ ] Injection — parameterised queries, no string-built SQL
- [ ] Broken Auth — JWT validation, session management
- [ ] Sensitive Data Exposure — encryption at rest and in transit
- [ ] Security Misconfiguration — no default passwords, no stack traces in responses
- [ ] XSS — input sanitisation for any HTML output

Full standard: `capability-packs/core/standards/security-baseline.md`