Name: security
Author: ErnestoCubo

Instruction file imported from ErnestoCubo/DomainRaptor (.github/instructions/security.instructions.md). Copyright stays with the author.

Security rules

Owner: security-officer. These rules are blocking. security-officer runs in parallel with qa-reviewer and devops-engineer on every PR.

Code hot paths (HARD RULE)

Risk	Forbidden	Required
SSRF	`httpx.get(f"https://{user_input}")`	Validate via `core.validators` first
SQL injection	f-string SQL, `text(f"SELECT … {x}")`	SQLAlchemy Core with bound params
Path traversal	`open(f"{dir}/{user_input}")`	`pathlib.Path` + `.resolve()` + boundary check
YAML	`yaml.load`	`yaml.safe_load`
Subprocess	`shell=True`, string command	`[argv]`, `shell=False`, `check=True`, `timeout=N`
Pickle	`pickle.loads` of external data	`json` / explicit schema
TLS	`verify=False`, `_create_unverified_context`	Default verification, pinned CA if needed

Secrets (HARD RULE)

API keys load from env or ~/.config/domainraptor/config.yaml only.
Never log secrets. Use utils.redact() on any structure that might contain Authorization, X-Api-Key, cookies, tokens.
detect-secrets baseline (.secrets.baseline) must stay current.
CI secrets: GitHub Secrets + OIDC. No PAT in env. No ${{ secrets.X }} printed via echo.

Dependencies (HARD RULE)

uv pip audit clean for high/critical. medium needs a comment in PR with remediation date. low documented in SECURITY.md.
Pin transitive CVE-prone deps in pyproject.toml [tool.uv.constraints] when no upstream fix.

Bandit (HARD RULE)

uv run bandit -r src/ → zero medium/high.
low requires # nosec B### -- reason (specific code, real reason).
No blanket # nosec ever.

Logging safety (HARD RULE)

Forbidden: logger.info("response: %s", response.content).
Forbidden: logger.debug("headers: %s", dict(headers)).
Required: log only metadata (status, length, redacted host).

IaC (when introduced)

checkov + trivy fs mandatory in CI.
Dockerfile: multi-stage, non-root user, base pinned by digest, HEALTHCHECK defined, .dockerignore present.
Terraform: no inline secrets, state in encrypted backend, drift check in CI.
Kubernetes: securityContext with runAsNonRoot: true, readOnlyRootFilesystem: true, no :latest images.

Threat-modeling cadence

security-officer plan runs at sprint kickoff for:

New external integrations (discovery/*_client.py, enrichment/*).
Storage backend changes.
Any task touching core/config.py or auth/secret loading.
Any PR introducing infra/, Dockerfile, *.tf.

Output: T###-sec-*.md task in current sprint with STRIDE summary.

Vulnerability disclosure

SECURITY.md at repo root describes reporting channel. security-officer owns updates to it.

{ "ocm": "1", "id": "ernestocubo-domainraptor-security-instructions", "kind": "skill", "name": "security", "description": "Security rules — owned by security-officer. Hot paths, secrets, deps, IaC.", "publisher": "ErnestoCubo", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "github-instructions" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Security rules — owned by security-officer. Hot paths, secrets, deps, IaC." ], "primary": false, "metadata": { "source": { "provider": "github-instructions", "repository": "https://github.com/ErnestoCubo/DomainRaptor", "path": ".github/instructions/security.instructions.md", "ref": "b6344ba8b4110120f29a2118d485f1e78e6fa134", "url": "https://github.com/ErnestoCubo/DomainRaptor/blob/b6344ba8b4110120f29a2118d485f1e78e6fa134/.github/instructions/security.instructions.md", "key": "ErnestoCubo/DomainRaptor/.github/instructions/security.instructions.md" }, "applies_to": "{src/**/*.py,pyproject.toml,uv.lock,.github/workflows/**,infra/**,Dockerfile,docker-compose*.yml,*.tf}" }, "instructions": "# Security rules\n\nOwner: **`security-officer`**. These rules are blocking. `security-officer`\nruns in parallel with `qa-reviewer` and `devops-engineer` on every PR.\n\n## Code hot paths (HARD RULE)\n\n| Risk | Forbidden | Required |\n|---|---|---|\n| SSRF | `httpx.get(f\"https://{user_input}\")` | Validate via `core.validators` first |\n| SQL injection | f-string SQL, `text(f\"SELECT … {x}\")` | SQLAlchemy Core with bound params |\n| Path traversal | `open(f\"{dir}/{user_input}\")` | `pathlib.Path` + `.resolve()` + boundary check |\n| YAML | `yaml.load` | `yaml.safe_load` |\n| Subprocess | `shell=True`, strin", "cost": { "context_tokens": 688 } }

security

About

Security rules

Code hot paths (HARD RULE)

Secrets (HARD RULE)

Dependencies (HARD RULE)

Bandit (HARD RULE)

Logging safety (HARD RULE)

IaC (when introduced)

Threat-modeling cadence

Vulnerability disclosure

Use it

Manifest

Reviews