Cline rules

1# Security Guidelines
2 
3## API Key and Credential Management
4**CRITICAL**: Never commit sensitive data to version control.
5 
6### Environment Variable Patterns
7```bash
8# Required AI service keys
9OPENAI_API_KEY=sk-...
10ANTHROPIC_API_KEY=sk-ant-...
11HUGGINGFACE_API_KEY=hf_...
12 
13# Optional service configurations
14AI_MODEL_TEMPERATURE=0.7
15AI_MAX_TOKENS=2048
16AI_RATE_LIMIT_PER_HOUR=100
17```
18 
19### Security Best Practices
20- Use `.env.local` for development secrets (never commit)
21- Create `.env.example` with dummy values to document required variables
22- Implement API key rotation strategies for production deployments
23- Use secure key management services (AWS Secrets Manager, Azure Key Vault, etc.)
24- Validate API keys on application startup and fail fast if missing
25 
26## AI Service Security
27 
28### Input Validation
29Always validate and sanitize inputs to AI services:
30```javascript
31// Validate prompt length and content
32function validatePrompt(prompt) {
33  if (!prompt || typeof prompt !== 'string') {
34    throw new Error('Invalid prompt: must be a non-empty string');
35  }
36  
37  if (prompt.length > 10000) {
38    throw new Error('Prompt too long: maximum 10,000 characters');
39  }
40  
41  // Remove potential injection attacks
42  const sanitized = prompt.replace(/[<>]/g, '');
43  return sanitized;
44}
45```
46 
47### Output Sanitization
48Sanitize AI service responses before displaying to users:
49```javascript
50// Sanitize AI responses for display
51function sanitizeAIResponse(response) {
52  // Remove potential script injections
53  return response
54    .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
55    .replace(/javascript:/gi, '')
56    .trim();
57}
58```
59 
60### Rate Limiting and Usage Control
61Implement safeguards against API abuse:
62```javascript
63// Example rate limiting implementation
64const rateLimiter = new Map();
65 
66function checkRateLimit(userId, maxRequests = 10, windowMs = 60000) {
67  const now = Date.now();
68  const userRequests = rateLimiter.get(userId) || [];
69  
70  // Remove old requests outside the window
71  const validRequests = userRequests.filter(time => now - time < windowMs);
72  
73  if (validRequests.length >= maxRequests) {
74    throw new Error('Rate limit exceeded');
75  }
76  
77  validRequests.push(now);
78  rateLimiter.set(userId, validRequests);
79}
80```
81 
82## Data Privacy and Compliance
83 
84### User Data Handling
85- Never log sensitive user inputs or AI responses
86- Implement data retention policies for AI interactions
87- Consider GDPR and other privacy regulations
88- Provide user controls for data deletion
89 
90### AI Service Data Policies
91- Understand data usage policies of each AI provider
92- Implement opt-out mechanisms for data training
93- Consider on-premise or private cloud AI solutions for sensitive data
94- Document data flow and processing for compliance audits
95 
96## Error Handling Security
97Avoid exposing sensitive information in error messages:
98```javascript
99// Secure error handling
100try {
101  const response = await aiService.complete(prompt);
102  return response;
103} catch (error) {
104  // Log detailed error internally
105  console.error('AI service error:', error);
106  
107  // Return generic error to user
108  throw new Error('AI service temporarily unavailable');
109}
110```
111 
112## Production Security Checklist
113- [ ] All API keys stored in secure environment variables
114- [ ] Input validation implemented for all AI service calls
115- [ ] Output sanitization applied to AI responses
116- [ ] Rate limiting configured for API endpoints
117- [ ] Error messages don't expose sensitive information
118- [ ] Data retention policies documented and implemented
119- [ ] Security headers configured for web applications
120- [ ] HTTPS enforced for all AI service communications