Generic Security Rules for Sourcegraph Cody

# Generic Security Rules for Sourcegraph Cody

## Input handling
- Treat all external input as untrusted (body, query, headers, webhooks, files).
- Validate at boundaries with explicit schema validation.
- Use allowlists over denylists.

## Secrets & auth
- Never commit secrets. Use env vars + secret manager.
- Rotate keys periodically and after incidents.
- Enforce least privilege for service tokens and DB roles.
- Require idempotency keys for money-moving or side-effectful endpoints.

## Safe defaults
- Deny-by-default authorization.
- Structured security logging for auth failures and permission denials.
- Never leak stack traces or secret values to clients.