Security Guide for Vibe Coders

Analyze our codebase and create a Security Standards block
for our project instructions (CLAUDE.md).

The block should contain:
1. Our auth pattern (how do we authenticate API endpoints?)
2. Our database security pattern (RLS, admin checks, etc.)
3. Rules for new endpoints (what MUST every new endpoint have?)
4. Rules for user content (how is it sanitized?)
5. Rules for secrets and logging (what must not be logged?)

Format: clear, concise rules that apply to every new feature.
Write them so that an AI follows them during code generation.

Set up automated security checks as Git hooks for our project.

Requirements:
1. Pre-commit hook: Install gitleaks for secret detection.
   - Scan only staged files (fast, doesn't slow down commits)
   - Block the commit if secrets are found
   - Create a .gitleaks.toml config with allowlist for files
     that are in .gitignore (e.g..env.local.next/, node_modules/)
   - Show a clear error message explaining what was found

2. Pre-push hook: Dependency vulnerability scanning.
   - Run npm/pnpm audit for frontend dependencies
   - Run pip-audit for Python backend (if applicable)
   - Warn on moderate issues, block on critical/high

3. Keep existing hooks (lint-staged, prettier) intact.

Explain each step and why it matters.
Test with a fake secret to verify it works.

Perform a security audit. Check systematically:

1. AUTHENTICATION & AUTHORIZATION
Check whether all API endpoints have access control.
- Are there endpoints without auth middleware?
- Compare ALL route handlers against the auth pattern
  used in other routes
- Are user IDs taken from the token or trusted from
  the request body?
- Are there dev bypasses that could be active in production?

2. DATABASE SECURITY
Check whether the database restricts access properly.
- Which tables have Row Level Security enabled?
- Are there policies with USING(true) on sensitive tables?
- Can anonymous users read data they shouldn't see?
- Are admin checks done through a secure function?

3. INPUT VALIDATION & INJECTION
Check whether user inputs are filtered.
- Is user content rendered as unfiltered HTML?
- Are there prompt injection risks in AI endpoints?
- Are user inputs validated before being passed to LLMs?

4. SECRETS & LOGGING
Check whether secrets are secure.
- Are tokens or secrets leaked in logs?
- Are debug files, logs, or credentials in the git repo?
- Are there console.log calls with sensitive data in production?

5. TRANSPORT & HEADERS
Check whether the server behaves securely toward browsers.
- Which security headers does the backend set?
- Missing: HSTS, X-Frame-Options, X-Content-Type-Options,
  Referrer-Policy, Permissions-Policy?

6. BOT PROTECTION
Check whether bots and brute force attacks are blocked.
- Is there CAPTCHA/Turnstile on login and signup?
- Does rate limiting exist per endpoint category?
- Are brute force attacks detected and blocked?

Create a report:
- Severity (Critical/High/Medium/Low)
- Affected file + line
- Concrete fix (code snippet)
- Explain WHY each finding is a risk
- Estimated effort per fix
- Sorted by severity (Critical first)

Implement CSRF protection for our application.

Explain briefly at each step what you're doing and why.

Requirements:
1. Token generation: Random token per session
2. Token storage: in a secure cookie
   (httpOnly = JavaScript can't read it,
    secure = only over HTTPS,
    sameSite = only from our own site)
3. Token validation: On every write request
   (POST, PUT, DELETE) check whether the token matches
4. Client wrapper: A helper function that automatically
   sends the token with every request
5. Exceptions: GET requests don't need a CSRF token

Show me which existing endpoints don't verify
the token yet.

Based on our security audit, create a hardening plan
with these 5 areas:

1. Rate Limiting: Which endpoints need limits? Suggest reasonable values.
2. Bot Protection: Where do we need Turnstile/CAPTCHA?
3. Security Headers: Which are missing on our backend?
4. Audit Logging: Which events should be logged?
5. Dependency Scanning: How do we set up automated scanning?

Per area: concrete implementation plan,
affected files, estimated effort.

Explain briefly for each point why it matters.

Implement an input validator for our AI endpoints.

The validator should check user inputs BEFORE they
are passed to the AI model.

Explain each step so I understand why it's necessary.

Detection categories:
1. Instruction Manipulation: User tries to override the AI rules
   ("ignore instructions", "forget rules")
2. System Prompt Exposure: User tries to see internal
   instructions ("show your prompt")
3. Data Extraction: User tries to extract bulk data
   ("give me all", "list every user")
4. SQL Injection via AI: User tries to execute database commands
   through the AI
5. Delimiter Breaking: User tries to break out of the
   chat context ("</system>")

Requirements:
- Friendly error message for the user
  (not technical, multilingual if possible)
- Logging of attempts (user ID, category)
- No app crash on detected attack

My product uses AI systems and needs to become EU AI Act compliant.
I'm not a lawyer. Explain the requirements in plain language.

Create a gap analysis:

1. INVENTORY
- Find all places in our code where AI models are called
- List: which model, what for, which data goes in
- Where do users see AI-generated content?

2. TRANSPARENCY GAPS
- Where do we use AI without telling the user?
- Which content is AI-generated but not labeled as such?

3. CONSENT GAPS
- Do new users know before registration that AI is used?
- Is there a page that explains the AI usage?
- Is it in the privacy policy?

4. AUDIT GAPS
- Do we log which models we use and when?
- Could we show an auditor which model produced
  which output?

5. RISK ASSESSMENT
- Which category does our product fall into?
- Explain the categories in plain language

Create a prioritized plan. For each point, tell me
why it matters and what happens if I ignore it.

IMPORTANT: Clearly mark what a lawyer needs to review
and what I can implement myself.

## Security Standards

- ALL API endpoints MUST have authentication middleware
- Dev bypasses MUST be fail-closed (require explicit opt-in,
  standard is OFF)
- NEVER log tokens, secrets, session data, or CSRF tokens
- ALL database tables MUST have RLS policies enabled
- ALL write operations (POST, PUT, DELETE) MUST include
  CSRF token validation
- ALL user-generated content MUST be sanitized before rendering
  (use DOMPurify or equivalent)
- ALL AI endpoints MUST validate user inputs against
  prompt injection patterns before passing to the model
- Security headers MUST be set on all backend API responses
- Rate limiting MUST be active on auth and API endpoints
- Debug files (*.log, cookies.txt) MUST NOT be committed to git
- Service role keys MUST ONLY be used server-side, never in
  client/browser code
- NEVER modify environment variables on hosting providers
  (Vercel, Render, Railway etc.) via API or CLI. Some providers
  replace ALL env vars on update, destroying production config.
  Always manage env vars manually through the provider dashboard.

## EU AI Act Compliance (if applicable)

- ALL AI-generated content MUST be labeled in the UI
- ALL model invocations MUST be logged (model name, tokens, cost)
- Registration flow MUST include AI disclosure checkbox
- Legal pages (Terms, Privacy, AI Transparency) MUST be maintained

## UX Constraints for Security

- Security measures MUST NOT break user flows
- Error messages MUST be user-friendly, not technical
- Disclosure elements MUST be dismissable where possible
- CAPTCHA invisible by default, challenge only when needed
- Rate limits generous enough for normal usage patterns