secure-coding-rules

Apply OWASP Top 10 2025 JavaScript/TypeScript security rules to your AI coding assistant with one command.

Auto-generates security guidelines for CLAUDE.md, .cursor/rules, .windsurf/rules, copilot-instructions.md, and AGENTS.md.

Quick Start

npx secure-coding-rules

Interactive prompts:

1. Select AI tool (Claude Code / Cursor / Windsurf / Copilot / AGENTS.md)
2. Select framework (React / Vue / Node.js / Vanilla) - auto-detected
3. Select security categories (all or individual)

Auto Mode

Analyzes your project and applies optimal settings automatically:

npx secure-coding-rules --yes

• Auto-detects existing AI tool config files and updates them
• Auto-detects framework from package.json (React, Vue, Node.js, etc.)
• Works in CI/CD and other non-interactive environments

Status Check

Check current project security rule status:

npx secure-coding-rules --check

Supported AI Tools

| AI Tool | Output | Existing files | |---------|--------|----------------| | Claude Code | CLAUDE.md | Auto-merge | | Cursor | .cursor/rules/*.mdc | Per-category files | | Windsurf | .windsurf/rules/*.md | Per-category files | | GitHub Copilot | .github/copilot-instructions.md | Auto-merge | | AGENTS.md | AGENTS.md | Auto-merge |

Security Categories (OWASP Top 10 2025)

| Code | Category | Description | |------|----------|-------------| | A01 | Broken Access Control | RBAC/ABAC, IDOR prevention, server-side authz | | A02 | Security Misconfiguration | Security headers, CORS, env vars | | A03 | Supply Chain Failures | npm audit, lockfile integrity, SRI (New in 2025) | | A04 | Cryptographic Failures | Secure hashing, encryption, key management | | A05 | Injection | XSS, SQLi, NoSQLi, Command Injection | | A06 | Insecure Design | Threat modeling, least privilege | | A07 | Authentication Failures | MFA, session management, password policy | | A08 | Data Integrity Failures | SRI, safe deserialization, CI/CD security | | A09 | Logging & Alerting | Security logging, sensitive data masking | | A10 | Error Handling | Fail-safe defaults, error info leakage (New in 2025) |

Frontend Modules

| Code | Category | Description | |------|----------|-------------| | FE-01 | XSS Prevention | Safe DOM manipulation, sanitization | | FE-02 | CSRF Protection | Token-based defense, SameSite cookies | | FE-03 | Content Security Policy | CSP headers, nonce, reporting | | FE-04 | Secure State | Safe state management, in-memory tokens |

How It Works

Rule Format

All security rules follow a consistent, AI-friendly structure:

### 1. Rule Title
- **DO**: What to do (specific instruction)
- **DON'T**: What to avoid
- **WHY**: Why it matters

## Code Examples
### Bad Practice / Good Practice

## Quick Checklist
- [ ] Checklist items

File Merging

If CLAUDE.md or other config files already exist, existing content is preserved and only the security section is added/updated:

<!-- js-secure-coding:start -->
(only this region is updated)
<!-- js-secure-coding:end -->

Re-running replaces only the marked region with the latest version.

Auto-Detection

secure-coding-rules analyzes your project at runtime:

• AI tools: Checks for CLAUDE.md, .cursor/, .windsurf/, .github/
• Framework: Reads package.json dependencies (React, Vue, Express, etc.)
• Smart prompts: Detected items are highlighted and prioritized in interactive mode

Manual Usage

You can also copy markdown files from src/templates/ directly without the CLI:

src/templates/
├── core/           # OWASP Top 10 2025 (A01-A10)
│   ├── access-control.md
│   ├── authentication.md
│   ├── cryptographic.md
│   ├── data-integrity.md
│   ├── error-handling.md
│   ├── injection.md
│   ├── logging-alerting.md
│   ├── secure-design.md
│   ├── security-config.md
│   └── supply-chain.md
└── frontend/       # Frontend 특화 보안 룰
    ├── xss-prevention.md
    ├── csrf-protection.md
    ├── csp.md
    └── secure-state.md

CLI Options

npx secure-coding-rules              Interactive mode (auto-detect)
npx secure-coding-rules --yes        Smart defaults
npx secure-coding-rules --check      Project security status
npx secure-coding-rules --dry-run    Preview (no file writes)
npx secure-coding-rules --lang ko    Run in Korean (한국어)
npx secure-coding-rules --help       Help
npx secure-coding-rules --version    Version

Language / 다국어

Auto-detects system locale (LANG env). Override with --lang:

npx secure-coding-rules --lang en    # English (default)
npx secure-coding-rules --lang ko    # 한국어

Legacy Templates

Original v1.0 prompt templates are preserved in the legacy/ directory.

References

• OWASP Top 10 2025
• Node.js Security Best Practices
• OWASP Cheat Sheet Series
• JavaScript Secure Coding Guide (KISA)

Contributing

PRs welcome! New security rules, AI tool adapters, or improvements to existing content.

License

MIT