Copilot instructions

1---
2description: Rails Security Guide
3applyTo: "**/*.rb"
4---
5 
6# Rails Security Guide
7 
8## Core Philosophy
9 
10- Security is not optional, it's fundamental
11- Follow the principle of least privilege
12- Never trust user input
13- Defense in depth - multiple layers of security
14- Stay updated with security best practices
15 
16## Authentication Principles
17 
18- Use Rails built-in authentication generator
19- Implement secure password requirements
20- Use has_secure_password for password handling
21- Implement session timeouts
22- Support multi-factor authentication when needed
23 
24## Authorization Strategy
25 
26- Authenticate every request
27- Authorize every action
28- Fail closed - deny by default
29- Check permissions at multiple levels
30- Log authorization failures
31 
32## Strong Parameters
33 
34- Always use strong parameters
35- Whitelist allowed attributes explicitly
36- Never permit entire parameter hashes
37- Handle nested attributes carefully
38- Document permitted parameters
39 
40## SQL Injection Prevention
41 
42- Use parameterized queries always
43- Avoid string interpolation in queries
44- Use Active Record query interface
45- Sanitize user input when necessary
46- Review raw SQL carefully
47 
48## Cross-Site Scripting (XSS)
49 
50- Escape output by default
51- Use Rails sanitize helpers appropriately
52- Be careful with raw and html_safe
53- Implement Content Security Policy
54- Validate and sanitize user input
55 
56## Cross-Site Request Forgery (CSRF)
57 
58- Enable CSRF protection globally
59- Include tokens in all forms
60- Verify tokens on state-changing requests
61- Handle AJAX requests properly
62- Document any CSRF exceptions
63 
64## Session Security
65 
66- Use secure session storage
67- Implement session expiration
68- Regenerate session IDs after login
69- Clear sessions on logout
70- Monitor for session hijacking
71 
72## Password Management
73 
74- Enforce strong password policies
75- Never store passwords in plain text
76- Use bcrypt for password hashing
77- Implement password reset securely
78- Support password managers
79 
80## API Security
81 
82- Use token-based authentication
83- Implement rate limiting
84- Version APIs from the start
85- Use HTTPS exclusively
86- Validate API input thoroughly
87 
88## File Upload Security
89 
90- Validate file types and sizes
91- Scan uploads for malware
92- Store files outside web root
93- Use random filenames
94- Implement access controls
95 
96## Secrets Management
97 
98- Use Rails credentials for secrets
99- Never commit secrets to version control
100- Rotate credentials regularly
101- Use different credentials per environment
102- Document credential requirements
103 
104## HTTPS and Transport Security
105 
106- Force SSL in production
107- Use secure cookies
108- Implement HSTS headers
109- Validate SSL certificates
110- Monitor certificate expiration
111 
112## Security Headers
113 
114- Implement Content Security Policy
115- Use X-Frame-Options
116- Set X-Content-Type-Options
117- Enable X-XSS-Protection
118- Configure Referrer-Policy
119 
120## Input Validation
121 
122- Validate on multiple levels
123- Use Active Record validations
124- Implement format validations
125- Check business logic constraints
126- Sanitize for output context
127 
128## Error Handling
129 
130- Don't expose sensitive information
131- Log security events appropriately
132- Use generic error messages
133- Monitor for attack patterns
134- Implement proper 404/500 pages
135 
136## Dependency Security
137 
138- Keep dependencies updated
139- Monitor for vulnerabilities
140- Use bundle audit regularly
141- Review new dependencies
142- Remove unused dependencies
143 
144## Rate Limiting
145 
146- Implement request throttling
147- Limit authentication attempts
148- Protect expensive operations
149- Use progressive delays
150- Monitor for abuse patterns
151 
152## Logging and Monitoring
153 
154- Log security-relevant events
155- Avoid logging sensitive data
156- Monitor for suspicious patterns
157- Set up security alerts
158- Review logs regularly
159 
160## Data Protection
161 
162- Encrypt sensitive data at rest
163- Use encryption in transit
164- Implement data retention policies
165- Support data deletion requests
166- Audit data access
167 
168## Third-Party Integrations
169 
170- Validate webhook signatures
171- Use OAuth appropriately
172- Limit API permissions
173- Monitor third-party access
174- Document integration security
175 
176## Security Testing
177 
178- Include security in test suite
179- Test authorization thoroughly
180- Verify input validation
181- Check for common vulnerabilities
182- Use security scanning tools
183 
184## Incident Response
185 
186- Have a response plan ready
187- Document security contacts
188- Practice incident procedures
189- Monitor for breaches
190- Learn from incidents
191 
192## Compliance Considerations
193 
194- Understand regulatory requirements
195- Implement necessary controls
196- Document security measures
197- Conduct regular audits
198- Stay informed on changes
199 
200## Development Practices
201 
202- Review code for security issues
203- Use security linters
204- Train team on security
205- Follow secure coding standards
206- Make security part of culture
207 
208## Common Vulnerabilities
209 
210- Mass assignment vulnerabilities
211- Insecure direct object references
212- Missing authorization checks
213- Weak authentication methods
214- Insufficient logging
215 
216## Security Checklist
217 
218- [ ] Authentication implemented properly
219- [ ] Authorization checked everywhere
220- [ ] Input validated and sanitized
221- [ ] Output escaped appropriately
222- [ ] HTTPS enforced in production
223- [ ] Secrets managed securely
224- [ ] Dependencies kept updated
225- [ ] Security headers configured
226- [ ] Logging implemented properly
227- [ ] Error handling reveals no secrets
228 
229## Best Practices Summary
230 
231- Never trust user input
232- Implement defense in depth
233- Keep dependencies updated
234- Log security events
235- Stay informed on threats
236 
237Remember: Security is everyone's responsibility. Build it in from the start, not as an afterthought.
238