ClaudesecuritySecurity

Security Claude Rules

Security-focused Claude rules for any codebase: OWASP top 10, secrets management, auth, and vulnerability prevention.

CLAUDE.md
- Treat all external input as untrusted; validate shape, type, and range
- Use environment-specific secret management (Vault, AWS Secrets Manager, Doppler)
- Implement proper session management: short-lived tokens, refresh rotation
- Use constant-time comparison for security-sensitive string equality checks
- Apply Content Security Policy and review it regularly
- Audit dependencies weekly with npm audit, pip-audit, or cargo audit
- Log security events (failed logins, permission errors) to immutable audit log
- Perform threat modeling before building new authentication flows

How to use with Claude

Create a `CLAUDE.md` file in your project root. Claude Code reads this on startup and follows your conventions throughout the session.

#security#claude#owasp#auth#coding-rules

Related Rules