67476ea59b
Same skills in .agents/skills (Codex) and .claude/skills (Claude Code): codeguard, security-review, dependency-vetting, pre-release-gate, authz-idor-audit, threat-model-light. Source: cj/claude-skills. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
22 lines
1.1 KiB
Markdown
22 lines
1.1 KiB
Markdown
---
|
|
description: Privacy & data protection (minimization, classification, encryption, rights, transparency)
|
|
languages:
|
|
- javascript
|
|
alwaysApply: false
|
|
tags:
|
|
- privacy
|
|
---
|
|
|
|
rule_id: codeguard-0-privacy-data-protection
|
|
|
|
- Implement strong cryptography, enforce HTTPS with HSTS, enable certificate pinning,
|
|
and provide user privacy features to protect data and anonymity.
|
|
- Use strong, up-to-date cryptographic algorithms for data in transit and at rest; securely hash passwords with established libraries.
|
|
- Enforce HTTPS exclusively and implement HTTP Strict Transport Security (HSTS).
|
|
- Implement certificate pinning to prevent man-in-the-middle attacks even if CAs are compromised.
|
|
- Minimize IP address leakage by blocking third-party external content loading where feasible.
|
|
- Maintain transparency by informing users about privacy limitations and data handling policies.
|
|
- Implement privacy-focused audit trails and access logging.
|
|
- Return "Invalid username or password" to prevent account enumeration
|
|
- Use Argon2 or bcrypt with unique salts per user
|
|
- Store sessions server-side with cryptographically random IDs
|