| Dimension | Shared | Only in A | Only in B | Overlap |
|---|---|---|---|---|
| Sections | 0 | 6 | 15 | 0% |
| Commands | 0 | 0 | 0 | — |
| Section tags | 1 | 1 | 4 | 17% |
What each file covers
Sections
0 shared · 6 only in A · 15 only in B- − Cline Rules for Megarepo
- − Rules Structure
- − How Cline Uses These Rules
- − Customization
- − Rules Bank Approach
- − Consistency with Other AI Assistants
- + Security Guidelines
- + API Key and Credential Management
- + Environment Variable Patterns
- + Required AI service keys
- + Optional service configurations
- + Security Best Practices
- + AI Service Security
- + Input Validation
- + Output Sanitization
- + Rate Limiting and Usage Control
- + Data Privacy and Compliance
- + User Data Handling
- + AI Service Data Policies
- + Error Handling Security
- + Production Security Checklist
Commands
neither file has anySection tags
1 shared · 1 only in A · 4 only in B- − architecture
- + setup
- + code-style
- + security
- + api
- do-not
Line diff
HerringtonDarkholme/megarepo · .clinerules/README.md
@@ −1 @@
1# Cline Rules for Megarepo
2
3This directory contains Cline Rules that provide system-level guidance for the Cline AI assistant when working on this AI setup repository.
4
5## Rules Structure
6
7The rules are organized into focused files that build upon each other:
8
91. **`01-core-principles.md`** - Fundamental principles including minimal change philosophy and AI-first development
102. **`02-development.md`** - Development guidelines for Node.js/Next.js AI projects
113. **`03-documentation.md`** - Documentation requirements and standards
124. **`04-security.md`** - Security guidelines for AI projects and API key management
13
14## How Cline Uses These Rules
15
16Cline automatically processes all Markdown files in this directory, combining them into a unified set of rules. The numeric prefixes help organize the files in a logical sequence, ensuring core principles are established before specific guidelines.
17
18## Customization
19
20These rules are tailored specifically for the Megarepo AI setup repository and should be updated as the project evolves. The rules emphasize:
21
22- **Minimal Changes**: Surgical, precise modifications that respect the repository's intentional simplicity
23- **AI-First Development**: Patterns and practices optimized for AI service integrations
24- **Security Best Practices**: Safe handling of API keys and sensitive data
25- **Node.js/Next.js Patterns**: Guidelines specific to the target technology stack
26
27## Rules Bank Approach
28
29This repository follows the "active rules" pattern where the `.clinerules/` directory contains only the rules that should be active. For projects with multiple contexts, consider creating a `clinerules-bank/` directory with additional rule sets that can be activated as needed.
30
31## Consistency with Other AI Assistants
32
33These rules are designed to work alongside other AI assistant configurations in this repository:
34- GitHub Copilot (`.github/copilot-instructions.md`)
35- Claude AI (`CLAUDE.md`)
36- Cursor AI (`.cursorrules`)
37- Gemini CLI (`GEMINI.md`)
38- Universal AI guidelines (`AGENT.md`, `AGENTS.md`)
39
40All configurations share common principles while being optimized for each assistant's specific capabilities.
HerringtonDarkholme/megarepo · .clinerules/04-security.md
@@ +1 @@
1# Security Guidelines
2
3## API Key and Credential Management
4**CRITICAL**: Never commit sensitive data to version control.
5
6### Environment Variable Patterns
7```bash
8# Required AI service keys
9OPENAI_API_KEY=sk-...
10ANTHROPIC_API_KEY=sk-ant-...
11HUGGINGFACE_API_KEY=hf_...
12
13# Optional service configurations
14AI_MODEL_TEMPERATURE=0.7
15AI_MAX_TOKENS=2048
16AI_RATE_LIMIT_PER_HOUR=100
17```
18
19### Security Best Practices
20- Use `.env.local` for development secrets (never commit)
21- Create `.env.example` with dummy values to document required variables
22- Implement API key rotation strategies for production deployments
23- Use secure key management services (AWS Secrets Manager, Azure Key Vault, etc.)
24- Validate API keys on application startup and fail fast if missing
25
26## AI Service Security
27
28### Input Validation
29Always validate and sanitize inputs to AI services:
30```javascript
31// Validate prompt length and content
32function validatePrompt(prompt) {
33 if (!prompt || typeof prompt !== 'string') {
34 throw new Error('Invalid prompt: must be a non-empty string');
35 }
36
37 if (prompt.length > 10000) {
38 throw new Error('Prompt too long: maximum 10,000 characters');
39 }
40
41 // Remove potential injection attacks
42 const sanitized = prompt.replace(/[<>]/g, '');
43 return sanitized;
44}
45```
46
47### Output Sanitization
48Sanitize AI service responses before displaying to users:
49```javascript
50// Sanitize AI responses for display
51function sanitizeAIResponse(response) {
52 // Remove potential script injections
53 return response
54 .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
55 .replace(/javascript:/gi, '')
56 .trim();
57}
58```
59
60### Rate Limiting and Usage Control
61Implement safeguards against API abuse:
62```javascript
63// Example rate limiting implementation
64const rateLimiter = new Map();
65
66function checkRateLimit(userId, maxRequests = 10, windowMs = 60000) {
67 const now = Date.now();
68 const userRequests = rateLimiter.get(userId) || [];
69
70 // Remove old requests outside the window
71 const validRequests = userRequests.filter(time => now - time < windowMs);
72
73 if (validRequests.length >= maxRequests) {
74 throw new Error('Rate limit exceeded');
75 }
76
77 validRequests.push(now);
78 rateLimiter.set(userId, validRequests);
79}
80```
81
82## Data Privacy and Compliance
83
84### User Data Handling
85- Never log sensitive user inputs or AI responses
86- Implement data retention policies for AI interactions
87- Consider GDPR and other privacy regulations
88- Provide user controls for data deletion
89
90### AI Service Data Policies
91- Understand data usage policies of each AI provider
92- Implement opt-out mechanisms for data training
93- Consider on-premise or private cloud AI solutions for sensitive data
94- Document data flow and processing for compliance audits
95
96## Error Handling Security
97Avoid exposing sensitive information in error messages:
98```javascript
99// Secure error handling
100try {
101 const response = await aiService.complete(prompt);
102 return response;
103} catch (error) {
104 // Log detailed error internally
105 console.error('AI service error:', error);
106
107 // Return generic error to user
108 throw new Error('AI service temporarily unavailable');
109}
110```
111
112## Production Security Checklist
113- [ ] All API keys stored in secure environment variables
114- [ ] Input validation implemented for all AI service calls
115- [ ] Output sanitization applied to AI responses
116- [ ] Rate limiting configured for API endpoints
117- [ ] Error messages don't expose sensitive information
118- [ ] Data retention policies documented and implemented
119- [ ] Security headers configured for web applications
120- [ ] HTTPS enforced for all AI service communications
@@ −1 +1 @@
1−# Cline Rules for Megarepo
1+# Security Guidelines
22
3−This directory contains Cline Rules that provide system-level guidance for the Cline AI assistant when working on this AI setup repository.
3+## API Key and Credential Management
4+**CRITICAL**: Never commit sensitive data to version control.
45
5−## Rules Structure
6+### Environment Variable Patterns
7+```bash
8+# Required AI service keys
9+OPENAI_API_KEY=sk-...
10+ANTHROPIC_API_KEY=sk-ant-...
11+HUGGINGFACE_API_KEY=hf_...
612
7−The rules are organized into focused files that build upon each other:
13+# Optional service configurations
14+AI_MODEL_TEMPERATURE=0.7
15+AI_MAX_TOKENS=2048
16+AI_RATE_LIMIT_PER_HOUR=100
17+```
818
9−1. **`01-core-principles.md`** - Fundamental principles including minimal change philosophy and AI-first development
10−2. **`02-development.md`** - Development guidelines for Node.js/Next.js AI projects
11−3. **`03-documentation.md`** - Documentation requirements and standards
12−4. **`04-security.md`** - Security guidelines for AI projects and API key management
19+### Security Best Practices
20+- Use `.env.local` for development secrets (never commit)
21+- Create `.env.example` with dummy values to document required variables
22+- Implement API key rotation strategies for production deployments
23+- Use secure key management services (AWS Secrets Manager, Azure Key Vault, etc.)
24+- Validate API keys on application startup and fail fast if missing
1325
14−## How Cline Uses These Rules
26+## AI Service Security
1527
16−Cline automatically processes all Markdown files in this directory, combining them into a unified set of rules. The numeric prefixes help organize the files in a logical sequence, ensuring core principles are established before specific guidelines.
28+### Input Validation
29+Always validate and sanitize inputs to AI services:
30+```javascript
31+// Validate prompt length and content
32+function validatePrompt(prompt) {
33+ if (!prompt || typeof prompt !== 'string') {
34+ throw new Error('Invalid prompt: must be a non-empty string');
35+ }
36+
37+ if (prompt.length > 10000) {
38+ throw new Error('Prompt too long: maximum 10,000 characters');
39+ }
40+
41+ // Remove potential injection attacks
42+ const sanitized = prompt.replace(/[<>]/g, '');
43+ return sanitized;
44+}
45+```
1746
18−## Customization
47+### Output Sanitization
48+Sanitize AI service responses before displaying to users:
49+```javascript
50+// Sanitize AI responses for display
51+function sanitizeAIResponse(response) {
52+ // Remove potential script injections
53+ return response
54+ .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
55+ .replace(/javascript:/gi, '')
56+ .trim();
57+}
58+```
1959
20−These rules are tailored specifically for the Megarepo AI setup repository and should be updated as the project evolves. The rules emphasize:
60+### Rate Limiting and Usage Control
61+Implement safeguards against API abuse:
62+```javascript
63+// Example rate limiting implementation
64+const rateLimiter = new Map();
2165
22−- **Minimal Changes**: Surgical, precise modifications that respect the repository's intentional simplicity
23−- **AI-First Development**: Patterns and practices optimized for AI service integrations
24−- **Security Best Practices**: Safe handling of API keys and sensitive data
25−- **Node.js/Next.js Patterns**: Guidelines specific to the target technology stack
66+function checkRateLimit(userId, maxRequests = 10, windowMs = 60000) {
67+ const now = Date.now();
68+ const userRequests = rateLimiter.get(userId) || [];
69+
70+ // Remove old requests outside the window
71+ const validRequests = userRequests.filter(time => now - time < windowMs);
72+
73+ if (validRequests.length >= maxRequests) {
74+ throw new Error('Rate limit exceeded');
75+ }
76+
77+ validRequests.push(now);
78+ rateLimiter.set(userId, validRequests);
79+}
80+```
2681
27−## Rules Bank Approach
82+## Data Privacy and Compliance
2883
29−This repository follows the "active rules" pattern where the `.clinerules/` directory contains only the rules that should be active. For projects with multiple contexts, consider creating a `clinerules-bank/` directory with additional rule sets that can be activated as needed.
84+### User Data Handling
85+- Never log sensitive user inputs or AI responses
86+- Implement data retention policies for AI interactions
87+- Consider GDPR and other privacy regulations
88+- Provide user controls for data deletion
3089
31−## Consistency with Other AI Assistants
90+### AI Service Data Policies
91+- Understand data usage policies of each AI provider
92+- Implement opt-out mechanisms for data training
93+- Consider on-premise or private cloud AI solutions for sensitive data
94+- Document data flow and processing for compliance audits
3295
33−These rules are designed to work alongside other AI assistant configurations in this repository:
34−- GitHub Copilot (`.github/copilot-instructions.md`)
35−- Claude AI (`CLAUDE.md`)
36−- Cursor AI (`.cursorrules`)
37−- Gemini CLI (`GEMINI.md`)
38−- Universal AI guidelines (`AGENT.md`, `AGENTS.md`)
96+## Error Handling Security
97+Avoid exposing sensitive information in error messages:
98+```javascript
99+// Secure error handling
100+try {
101+ const response = await aiService.complete(prompt);
102+ return response;
103+} catch (error) {
104+ // Log detailed error internally
105+ console.error('AI service error:', error);
106+
107+ // Return generic error to user
108+ throw new Error('AI service temporarily unavailable');
109+}
110+```
39111
40−All configurations share common principles while being optimized for each assistant's specific capabilities.
112+## Production Security Checklist
113+- [ ] All API keys stored in secure environment variables
114+- [ ] Input validation implemented for all AI service calls
115+- [ ] Output sanitization applied to AI responses
116+- [ ] Rate limiting configured for API endpoints
117+- [ ] Error messages don't expose sensitive information
118+- [ ] Data retention policies documented and implemented
119+- [ ] Security headers configured for web applications
120+- [ ] HTTPS enforced for all AI service communications
