Bugbot Rules: Security

Relevant source files

The following files were used as context for generating this wiki page:

• bugbot-rules/xss-innerhtml.md
• bugbot-rules/pii-in-logs.md
• bugbot-rules/auth-before-irreversible-action.md
• bugbot-rules/rate-limit-xff-spoofing.md
• claude-md-snippets/critical.md
• bugbot-rules/secret-in-derived-text.md
• CRITICAL-PATTERNS.md

The Bugbot Rules: Security module represents a set of stack-agnostic, critical bug patterns identified across multiple production projects. These rules are designed to be applied mechanically via automated tools (like CLAUDE.md triggers or custom CI linters) to prevent recurring security vulnerabilities such as data leaks, unauthorized actions, and injection attacks.

This system categorizes bugs based on their severity—prioritizing security, privacy, and financial impact—and provides detection signatures to ensure these patterns are caught during code reviews or through automated scanning. These rules are especially relevant for projects handling authentication, public-facing endpoints, or sensitive user input.

Sources: README.md:16-24, README.md:65-72, INTEGRATION.md:143-156

Core Security Patterns

Security rules in this repository are classified as CRITICAL (marked K1..K14) because they involve high stakes such as PII (Personally Identifiable Information) exposure, privilege escalation, or irreversible data loss. These patterns must be checked in every PR involving sensitive logic.

Authentication and Authorization

A recurring vulnerability involves performing irreversible external actions before confirming that the local state has been successfully updated and secured. This often leads to "fail-open" scenarios where a user receives a service (e.g., a message sent or a payment processed) even if the system fails to record the transaction or verify the user's remaining quota.

Sources: bugbot-rules/auth-before-irreversible-action.md:1-15, INTEGRATION.md:146-148

Information Disclosure and Data Leaks

Information leaks often occur through "derived text"—where secrets like API tokens or DSN strings are concatenated into URLs or error messages that are subsequently logged or sent to monitoring tools like Sentry.

Pattern ID	Feature	Description	Detection Signature
K13	Secret in Derived Text	Secrets embedded in URLs or shell commands leak to logs/Sentry.	f"...{token}..." or urljoin flowing to logger or raise.
K5	PII in Logs	Personal data (emails, phones) recorded in plain text.	Plain variables (email, body) in logger.info or print.
K6	Secret in Response	Technical stack traces or raw secrets returned to the client.	Generic error handlers returning str(exception) to users.

Sources: bugbot-rules/secret-in-derived-text.md:1-16, bugbot-rules/pii-in-logs.md:1-10, CRITICAL-PATTERNS.md

Injection and Client-Side Security

Cross-Site Scripting (XSS)

The use of innerHTML or dangerouslySetInnerHTML without proper sanitization allows for XSS attacks. The bugbot rule flags any direct assignment of unsanitized strings to these properties, especially when the source is external (API, URL params, or user input).

Rate Limit Bypass (XFF Spoofing)

Security decisions, such as rate limiting or IP-based blocking, must not trust the X-Forwarded-For (XFF) header unless the source is a verified, trusted proxy. Attackers can easily spoof this header to bypass restrictions.

• Vulnerable Logic: Using request.headers.get("x-forwarded-for") to identify a user.
• Secure Logic: Relying on the direct connection remote address or a specific header injected by a known load balancer (e.g., cf-connecting-ip for Cloudflare).

Sources: bugbot-rules/rate-limit-xff-spoofing.md:1-20

Multi-Tenant Isolation

In multi-tenant systems, "Tenant Row Scoping" is a critical requirement. Every query (SELECT, UPDATE, DELETE) must include a predicate for the authenticated tenant ID to prevent privilege escalation or accidental data exposure between customers.

Key Rules for Tenancy

1. Predicate Enforcement: Every query must filter by tenant_id derived from the authenticated session, not from user-provided parameters.
2. Atomic Insertion: When creating records, the tenant_id must be hardcoded from the session context to prevent one tenant from creating data belonging to another.
3. Conflict Keys: Unique constraints must include the tenant_id to allow identical IDs/names across different tenants without collision.

Sources: INTEGRATION.md:154-156, claude-md-snippets/critical.md:5

Conclusion

The security rules within the Bugbot module provide a robust defense-in-depth strategy by codifying recurring failures found in production. By integrating these rules into CLAUDE.md triggers and automated reviews, the project ensures that high-impact vulnerabilities—ranging from PII leaks in logs to XSS and tenant isolation failures—are caught systematically during the development lifecycle.

Sources: INTEGRATION.md:1-15, README.md:1-10