1
# Secure Coding Rules
2
3
A CLAUDE.md/AGENTS.md-style rules set covering secrets handling, input validation,
4
injection prevention, authorization, dependency hygiene, and PII logging. Unlike a
5
workflow, this doesn't run as a procedure — it's loaded as standing rules the agent
6
follows on every edit for the life of the project.
7
8
## When to use
9
10
- Load into any project as baseline rules, especially ones handling user data, auth,
11
  or payments.
12
- Pair with `pr-reviewer` — these rules constrain how code is written; the reviewer
13
  checklist catches what slips through.
14
- Good as an always-on rules file (`.claude/rules/`, a `CLAUDE.md` include, a Cursor
15
  rule) rather than something invoked per-task.
16
17
## Install
18
19
```bash
20
npx openagents-cli add openagents/secure-coding-rules
21
```
22
23
| Runtime | Installed to |
24
|---|---|
25
| `claude-code` | `.claude/skills/secure-coding-rules/` |
26
| `cursor` | `.cursor/rules/secure-coding-rules/` |
27
| `codex` | `.codex/skills/secure-coding-rules/` |
28
| `openai-agents` | `.openai-agents/secure-coding-rules/` |
29
| `langgraph` | `.langgraph/secure-coding-rules/` |
30
| `generic` | `.openagents/secure-coding-rules/` |
31
32
For `claude-code`/`cursor`, consider also referencing `RULES.md` directly from your
33
project's own `CLAUDE.md`/rules file (e.g. `@.claude/skills/secure-coding-rules/RULES.md`)
34
so it's always in context rather than only when explicitly invoked.
35
36
## Inputs
37
38
None — this package has no runtime parameters. It's a static rules file.
39
40
## Example run
41
42
```
43
> Load the secure-coding-rules and then implement the new /api/transfer endpoint.
44
```
45
46
The agent applies the rules while writing the endpoint: parameterized queries,
47
resource-level authorization on the transfer target, input validation on amount/
48
currency, no logging of account numbers, and no secrets in the diff.
49
50
## Files
51
52
- `RULES.md` — the rules themselves (entry point): secrets, input validation,
53
  injection prevention, authz/authn, dependency hygiene, logging/PII.
54
- `checklists/owasp-quick.md` — a fast pre-ship pass mapped to the OWASP Top 10.
55
56
## Limitations
57
58
- Rules, not enforcement — nothing here runs a scanner or blocks a commit; pair with
59
  static analysis / secret-scanning tooling in CI for automated enforcement.
60
- Written to be language/framework-agnostic; teams with a specific stack (e.g. a
61
  particular ORM) may want to extend it with stack-specific examples.
62
- Not a substitute for a real security review on high-risk changes (auth redesigns,
63
  crypto, payment flows).
64