Cline rules

1# Security
2 
3## Brief overview
4 
5This repository follows pnpm Security Best Practices to harden the supply chain and reduce the attack surface of the dependency tree.
6 
7## Supply-chain hardening controls
8 
9| Control | File | Description |
10|---|---|---|
11| Ignore lifecycle scripts | `.npmrc` | `ignore-scripts=true` prevents arbitrary code execution during install |
12| Block git deps | `.npmrc` | `allow-git=none` rejects git-source dependencies |
13| Install cooldown | `.npmrc` | `min-release-age=30` blocks packages newer than 30 days |
14| pnpm trust policy | `.pnpm-workspace.yaml` | `trustPolicy: no-downgrade` refuses versions with weaker trust signals |
15| Strict dep builds | `.pnpm-workspace.yaml` | `strictDepBuilds: true` fails install on unapproved build scripts |
16| Block exotic subdeps | `.pnpm-workspace.yaml` | `blockExoticSubdeps: true` blocks git/tarball in transitive deps |
17| Lockfile lint | `package.json` | `lockfile-lint` validates integrity, host, HTTPS on every install |
18| Dependabot cooldown | `.github/dependabot.yml` | 7-day cooldown before auto-upgrading dependencies |
19| CODEOWNERS | `.github/CODEOWNERS` | Mandatory review for lockfiles and package manager config |
20| CI hardening | `.github/workflows/ci.yml` | Deterministic install (`pnpm ci --ignore-scripts`) + lockfile validation |
21| Dev container | `.devcontainer/devcontainer.json` | Isolated environment with `--cap-drop=ALL` and `--no-new-privileges` |
22 
23## Secret management
24 
25- Never store plaintext secrets in `.env`, `.env.dev`, or any committed file
26- Use a secrets manager (Infisical, 1Password) and inject at runtime:
27  - `infisical run -- pnpm run dev`
28  - `op run -- pnpm start`
29- Never commit `wrangler.toml` with real credentials
30 
31## Pre-install audit tools (recommended)
32 
33```bash
34# npq — pre-install security auditor
35pnpm install -g npq
36pnpq install <package>
37 
38# Socket Firewall — real-time malicious package blocker
39pnpm install -g sfw
40sfw pnpm install <package>
41```
42 
43## Secure local development
44 
45- Use the provided Dev Container (`.devcontainer/devcontainer.json`) for isolated development
46- The container drops all capabilities, disables proto pollution, and enforces `ignore-scripts` and `allow-git=none`
47- Run `pnpm ci --ignore-scripts --prefer-offline` instead of `pnpm install` for deterministic installs
48