Security and Compliance
Relevant source files
The following files were used as context for generating this wiki page:
Security and Compliance within the ECC project is an integrated framework designed to identify, remediate, and prevent vulnerabilities throughout the software development lifecycle. The system relies on specialized agents, mandatory pre-commit guidelines, and a comprehensive security review skill to ensure that all code—especially that involving authentication, user input, and sensitive data—meets high security standards.
The project enforces a "Security-First" principle, where security is not optional and must be addressed pro-actively before code reaches production. This includes automated vulnerability detection, secrets management, and adherence to the OWASP Top 10 guidelines. Developers are encouraged to delegate complex security tasks to the security-reviewer agent and follow the established Review Workflow.
Sources: AGENTS.md:12, agents/security-reviewer.md:16-20, rules/common/security.md:3-13
Core Security Framework
The security architecture is built upon three pillars: automated auditing, strict coding rules, and a dedicated review agent. The framework is designed to trigger specialized reviews whenever sensitive areas of the codebase are modified.
Security Review Triggers
Security reviews are mandatory when changes involve:
- Authentication or authorization logic.
- Handling user input or file uploads.
- Creation of new API endpoints.
- Integration with third-party APIs or payment features.
- Handling of secrets, credentials, or PII (Personally Identifiable Information).
Sources: skills/security-review/SKILL.md:11-19, agents/security-reviewer.md:104-106
The Security Reviewer Agent
The security-reviewer is a specialized specialist agent that uses tools like Grep, Bash, and Glob to scan for vulnerabilities. Its core responsibilities include:
- Vulnerability Detection: Identifying OWASP Top 10 issues.
- Secrets Detection: Finding hardcoded API keys or tokens.
- Input Validation: Ensuring all user inputs are sanitized.
- Dependency Auditing: Running
npm auditto check for vulnerable packages.
Sources: agents/security-reviewer.md:5-29
Security Review Workflow
The following diagram illustrates the standard operating procedure for a security review when new code is introduced.
This flowchart depicts the iterative process of scanning, checking against OWASP standards, and remediating high-risk patterns.
Sources: agents/security-reviewer.md:36-68
Secrets and Sensitive Data Management
ECC enforces a zero-tolerance policy for hardcoded secrets. All sensitive data must be managed via environment variables or cloud-based secrets managers.
Mandatory Practices
- No Hardcoding: Secrets such as API keys and tokens must never appear in source code.
- Environment Variables: Use
process.envfor local development. - Secrets Rotation: Credentials must be rotated at least quarterly or immediately upon suspected exposure.
- Log Sanitization: Redact secrets, passwords, and PII from all logs and user-facing error messages.
Sources: rules/common/security.md:15-20, skills/security-review/SKILL.md:21, skills/security-review/cloud-infrastructure-security.md:46-55
Secrets Detection Patterns
The opensource-sanitizer agent uses specific regex patterns to detect leaked credentials before public release:
| Target | Pattern Example / Identifier | Severity |
|---|---|---|
| AWS Keys | AKIA[0-9A-Z]{16} | CRITICAL |
| DB URLs | (postgres|mysql|mongodb)://[^:]+:[^@]+@ | CRITICAL |
| Private Keys | -----BEGIN RSA PRIVATE KEY----- | CRITICAL |
| Slack Webhooks | https://hooks.slack.com/services/... | CRITICAL |
| High Entropy | ^[A-Z_]+=[A-Za-z0-9+/=_-]{32,}$ | WARNING |
Sources: agents/opensource-sanitizer.md:35-71
Web and Infrastructure Security
For web-based applications and cloud deployments, ECC extends common security guidelines with specific requirements for headers, networking, and CI/CD.
Web Security Rules
Web applications must implement a strict Content Security Policy (CSP) and use secure headers to prevent XSS and Clickjacking.
The sequence diagram shows the interaction between the user and application, highlighting validation and sanitization steps.
Sources: rules/web/security.md:6-34, skills/security-review/references/security-checklist.md:58-62
Cloud Security Baseline
Infrastructure must be configured according to the Principle of Least Privilege (PoLP).
- IAM: Service accounts should use OIDC instead of long-lived tokens in CI/CD.
- Network: Databases must not be publicly accessible; Security Groups must be restricted to internal VPC traffic where possible.
- Storage: S3 buckets must be private by default.
Sources: skills/security-review/cloud-infrastructure-security.md:15-32, 60-90
Security Checklist
A mandatory checklist is enforced before any commit is finalized to ensure compliance with project standards.
| Category | Requirement | Source Reference |
|---|---|---|
| Input | Validate all user inputs with schemas (e.g., Zod) | security-checklist.md:10 |
| SQL | Use parameterized queries only | security-checklist.md:27 |
| XSS | Sanitize user-provided HTML with DOMPurify | security-checklist.md:64 |
| CSRF | Enable CSRF tokens on state-changing operations | security-checklist.md:73 |
| Auth | Store tokens in httpOnly/Secure/SameSite=Strict cookies | SKILL.md:24 |
| Rate Limit | Apply per-IP/User limits on all API endpoints | security-checklist.md:79 |
Sources: skills/security-review/references/security-checklist.md, skills/security-review/SKILL.md:21-29
Conclusion
Security and Compliance in the ECC repository is a proactive, multi-layered discipline. By combining the automated vigilance of the security-reviewer and opensource-sanitizer agents with strict adherence to the Security Checklist, the project minimizes its attack surface and ensures that sensitive data remains protected. The integration of these security protocols into the daily development workflow—from pre-commit checks to cloud infrastructure configuration—is fundamental to maintaining system integrity and user trust.