Cline rules

1---
2description: Security best practices and sensitive data handling for mtg-utils
3author: Simone Gasbarroni
4version: 1.0
5tags: ["security", "best-practices", "sensitive-data"]
6---
7 
8# Security Practices
9 
10## Sensitive Data Handling
11 
12This document outlines security best practices for handling sensitive information in the mtg-utils project.
13 
14---
15 
16## Files to NEVER Process
17 
18### Environment Variables
19 
20- **DO NOT** read or process `.env` files
21- **DO NOT** include environment variable contents in any output
22- **ALWAYS** treat `.env` as a blacklisted pattern
23 
24### Configuration Files
25 
26- **DO NOT** read `config.json` or any configuration files containing credentials
27- **NEVER** expose binder IDs, API keys, or tokens in logs or outputs
28- **MUST** sanitize any configuration data before displaying
29 
30### Credentials and Tokens
31 
32- **NEVER** commit or store actual API tokens
33- **NEVER** hardcode sensitive credentials in source code
34- **ALWAYS** use environment variables or secure secret management
35 
36---
37 
38## Sensitive Data Patterns to Detect
39 
40The following patterns indicate sensitive data that should be redacted:
41 
42| Pattern | Example | Action |
43|---------|---------|--------|
44| `binder_id` | `abc123xyz` | Remove from output |
45| API Key | `sk-...` | Redact completely |
46| Token | `ghp_xxx` | Remove completely |
47| Email | `user@example.com` | Consider anonymization |
48 
49---
50 
51## Best Practices
52 
53### In Code
54 
55```python
56# ✅ GOOD - Use environment variables
57import os
58 
59binder_id = os.environ.get("MOXFIELD_BINDER_ID")
60 
61# ❌ BAD - Hardcoded secrets
62binder_id = "abc123xyz"  # NEVER DO THIS
63```
64 
65### In Logs
66 
67```python
68# ✅ GOOD - Sanitized logging
69logger.info(f"Processing binder: ***{binder_id[-4:]}")
70 
71# ❌ BAD - Full credential exposure
72logger.info(f"Processing binder: {binder_id}")
73```
74 
75### In Configuration
76 
77```json
78// ❌ BAD - Store real binder ID
79{
80  "binder_id": "real-binder-id-12345"
81}
82 
83// ✅ GOOD - Use placeholder
84{
85  "binder_id": "YOUR_MOXFIELD_BINDER_ID_HERE"
86}
87```
88 
89---
90 
91## Security Checklist
92 
93Before committing code:
94 
95- [ ] No `.env` files included
96- [ ] No hardcoded credentials
97- [ ] No exposed API keys or tokens
98- [ ] No sensitive user data in logs
99- [ ] Configuration files use placeholders
100 
101---
102 
103## Emergency Response
104 
105If sensitive data is accidentally exposed:
106 
1071. **IMMEDIATELY** remove the data from the codebase
1082. **IMMEDIATELY** change any exposed credentials
1093. Review recent commits for additional exposure
1104. Update `.gitignore` to prevent future occurrences
111