Secure Flow

Secure Flow Skill

This skill provides comprehensive security guidance to help AI coding agents generate secure code, perform security reviews, and implement security best practices. It is based on Secure Flow, a security framework that embeds secure-by-default practices into AI coding workflows.

When to Use This Skill

This skill should be activated when:

• Writing new code in any language
• Reviewing or modifying existing code
• Implementing security-sensitive features (authentication, cryptography, data handling, etc.)
• Working with user input, databases, APIs, or external services
• Configuring cloud infrastructure, CI/CD pipelines, or containers
• Handling sensitive data, credentials, or cryptographic operations
• Performing security assessments, threat modeling, or compliance validation
• Creating security tests or remediating vulnerabilities

How to Use This Skill

When writing or reviewing code:

1. Always-Apply Rules: Some rules MUST be checked on every code operation:

• Security best practices for authentication and authorization
• Input validation and sanitization
• Secure credential management
• Cryptographic best practices

2. Context-Specific Rules: Apply rules from /rules directory based on the task:

• Code Generation: Use secure-flow-create-secure-template.md when creating new code templates
• Security Testing: Use secure-flow-create-security-tests.md when generating security tests
• Threat Modeling: Use secure-flow-create-threat-model.md when analyzing security threats
• Vulnerability Remediation: Use secure-flow-security-remediation.md when fixing vulnerabilities
• API Security: Use secure-flow-review-api-auth.md when reviewing API endpoints
• Compliance: Use secure-flow-validate-compliance.md when validating compliance requirements
• Docker Security: Use secure-flow-harden-dockerfile-fips.md when hardening containers
• CI/CD Security: Use secure-flow-gate-critical-vulns.md when setting up security gates
• CISA KEV: Use secure-flow-fix-exploitable-vulns.md when fixing exploited vulnerabilities
• AI Security: Use secure-flow-explain-ai-threats.md when working with AI applications

3. Proactive Security: Don't just avoid vulnerabilities—actively implement secure patterns:

• Use parameterized queries for database access
• Validate and sanitize all user input
• Apply least-privilege principles
• Use modern cryptographic algorithms and libraries
• Implement defense-in-depth strategies
• Follow secure coding standards and best practices

Secure Flow Security Rules

The security rules are available in the rules/ directory.

Usage Workflow

When generating or reviewing code, follow this workflow:

1. Initial Security Check

Before writing any code:

• Check: Will this handle credentials? → Apply secure credential management practices
• Check: What language/framework am I using? → Identify applicable security rules
• Check: What security domains are involved? → Load relevant rule files

2. Code Generation

While writing code:

• Apply secure-by-default patterns from relevant Secure Flow rules
• Add security-relevant comments explaining choices
• Follow framework-specific security best practices

3. Security Review

After writing code:

• Review against implementation checklists in each rule
• Verify no hardcoded credentials or secrets
• Validate that all applicable security rules have been followed
• Explain which security rules were applied
• Highlight security features implemented

Available Workflows

Code Generation & Templates

• `secure-flow-create-secure-template` - Generate secure code templates with security best practices built-in

Security Testing

• `secure-flow-create-security-tests` - Create comprehensive security test cases and validation scripts

Threat Analysis

• `secure-flow-create-threat-model` - Generate threat models for applications and systems using STRIDE methodology
• `secure-flow-explain-ai-threats` - Explain AI-specific security threats and mitigations

Vulnerability Management

• `secure-flow-security-remediation` - Scan and fix high-impact vulnerabilities in the codebase
• `secure-flow-fix-exploitable-vulns` - Fix CISA Known Exploited Vulnerabilities (KEV) found in your codebase
• `secure-flow-gate-critical-vulns` - Set up CI/CD checks to block critical vulnerabilities

API & Service Security

• `secure-flow-review-api-auth` - Review and add authentication to API endpoints

Compliance & Validation

• `secure-flow-validate-compliance` - Validate compliance with security frameworks and standards (SOC 2, ISO 27001, HIPAA, PCI DSS)

Infrastructure Security

• `secure-flow-harden-dockerfile-fips` - Make Dockerfiles FIPS compliant with security hardening

Implementation Checklist

• [ ] Identified applicable security rules for the task
• [ ] Applied secure-by-default patterns
• [ ] Validated input and output handling
• [ ] Verified authentication and authorization
• [ ] Checked for hardcoded credentials
• [ ] Applied framework-specific security best practices
• [ ] Reviewed against security checklists
• [ ] Documented security decisions

rule_id: secure-flow-create-secure-template

Create Secure Template

Help create complete, production-ready, secure boilerplate template for requested pattern or framework. Secure by default, follows industry best practices.

Template Requirements Analysis

• Understand requested pattern (framework/language, application type, deployment environment, security requirements)
• Identify security requirements (authentication, authorization, data protection, compliance needs)

Framework-Specific Security Best Practices

• Python: Security headers/middleware, JWT with secure signing, RBAC, input validation (Pydantic/Marshmallow), secrets management, secure defaults (DEBUG=False, HTTPS enforced), logging with secret masking
• Node.js: Helmet.js, CORS, rate limiting, JWT with secure signing, input validation (Joi/Yup)
• Terraform: S3 encryption, IAM least privilege, network security

Complete Template Structure

• Provide project structure (app/, tests/, config/, .env.example)
• Configuration management (environment-based, secure defaults, secrets management)
• Authentication (JWT, token refresh, password reset, MFA support)
• Authorization (RBAC, permission checking, resource-level)
• Input validation (schema validation, type checking, range validation)
• Security headers (CSP, HSTS, X-Frame-Options, etc.)
• Error handling (secure error messages, proper status codes)
• Logging/monitoring (security events, audit trails, secret masking)
• Database security (encrypted connections, parameterized queries, least privilege)
• API security (rate limiting, input validation, CORS)
• Testing infrastructure (unit/integration/security tests)
• CI/CD security (secret scanning, dependency scanning, SAST)

Code Implementation

• Include complete, working code examples for main application setup
• Authentication endpoints, protected endpoints, input validation
• Error handling, security headers, logging, database connection
• Provide complete, production-ready code following security best practices from day one
• Include comments explaining security decisions
• Template should be immediately usable and secure by default

Implementation Checklist

• [ ] Analyzed template requirements and security needs
• [ ] Applied framework-specific security best practices
• [ ] Created complete project structure
• [ ] Implemented configuration management with secure defaults
• [ ] Added authentication and authorization
• [ ] Implemented input validation and security headers
• [ ] Added error handling and logging/monitoring
• [ ] Configured database and API security
• [ ] Included testing infrastructure
• [ ] Added CI/CD security scanning
• [ ] Provided complete, working code examples
• [ ] Included security decision comments

rule_id: secure-flow-create-security-tests

Create Security Tests

Help generate security-focused unit tests for specified routes, functions, or components. Verify security assumptions and catch vulnerabilities.

Code Analysis

• Identify security boundaries (authentication requirements, authorization checks, input validation points, access control logic, trust boundaries)
• Security features (authentication, authorization, input validation, output encoding, error handling, rate limiting, session management, CSRF protection, security headers)
• Attack vectors (authentication/authorization bypass, injection attacks, access control bypass, session hijacking, CSRF, information disclosure)

Comprehensive Test Cases

• Generate tests for:
• Authentication: valid/invalid credentials, expired tokens, missing tokens, SQL injection/XSS in username
• Authorization: authorized/unauthorized access, role escalation, IDOR, path traversal
• Input validation: SQL injection, XSS, command injection, path traversal, LDAP/XML injection, edge cases
• Access control: resource ownership, permission boundaries, bypass attempts
• Rate limiting: within/exceeding limits, per-user/IP
• Error handling: no stack traces, no sensitive data, generic errors
• Session management: creation, expiration, invalidation, hijacking prevention
• CSRF protection: valid/invalid/missing tokens

Test Framework Integration

• Use appropriate framework (pytest, Jest, JUnit, etc.)
• Organize tests clearly (AAA pattern, isolation, setup/teardown)
• Create mocks for external dependencies (authentication, database, external APIs, file system, network)
• Generate complete, runnable test code covering all security aspects, edge cases, and attack vectors
• Use appropriate testing frameworks and follow best practices

Implementation Checklist

• [ ] Analyzed code for security boundaries and features
• [ ] Identified attack vectors
• [ ] Generated authentication test cases
• [ ] Generated authorization test cases
• [ ] Generated input validation test cases
• [ ] Generated access control test cases
• [ ] Generated rate limiting test cases
• [ ] Generated error handling test cases
• [ ] Generated session management test cases
• [ ] Generated CSRF protection test cases
• [ ] Integrated with appropriate test framework
• [ ] Created mocks for external dependencies
• [ ] Ensured complete, runnable test code

rule_id: secure-flow-create-threat-model

Create Threat Model

Help perform comprehensive, lightweight threat modeling analysis of specified component, service, or application. Practical, developer-focused, actionable.

Component Analysis

• Understand component (type, purpose, technology stack, dependencies, data flow, user interactions)
• Identify attack surfaces:
• Data entry points: API endpoints, user input, webhooks, message queues, file imports, external APIs, configuration, command line
• Trust boundaries: authentication, network, service, privilege, data, process
• External dependencies: libraries, APIs, cloud services, databases, message brokers, CDNs, auth providers
• Data storage/transmission: databases, file systems, caches, logs, network, backups

STRIDE Threat Analysis

• Spoofing: user/service/identity spoofing (weak/missing authentication, session hijacking, credential theft)
• Tampering: data in transit/at rest, configuration/code tampering (missing integrity checks, weak encryption, missing access controls)
• Repudiation: user/system actions, transaction repudiation (missing audit logs, inadequate logging, no non-repudiation)
• Information Disclosure: data/log/error exposure, side channels (insecure APIs, missing access controls, inadequate encryption, stack traces, timing attacks)
• Denial of Service: resource exhaustion (CPU, memory, disk, connections), application/network/dependency DoS (missing rate limiting, expensive operations, DDoS, external API failures)
• Elevation of Privilege: privilege escalation (missing authorization, weak access controls, horizontal/vertical escalation, code execution)

Prioritized Threat Analysis

• For each threat:
• Attack scenario: steps, prerequisites, example
• Likelihood assessment: attack complexity, required skills, attack surface, existing controls, motivation
• Impact assessment: data/system/business/compliance/reputation impact
• Risk rating: likelihood × impact, priority
• Current mitigations: what exists, effectiveness, gaps
• Recommended mitigations: immediate/short-term/long-term actions, implementation, cost/benefit

Top 3-5 Abuse Cases

• Prioritize most likely high impact, high impact lower likelihood, common attack patterns, business-critical, compliance violations
• For each: attack vector, impact, detection, prevention, response
• Make practical, developer-focused, actionable
• Focus on real threats with specific, implementable recommendations

Implementation Checklist

• [ ] Analyzed component and identified attack surfaces
• [ ] Performed STRIDE threat analysis
• [ ] Assessed likelihood and impact for each threat
• [ ] Identified current mitigations and gaps
• [ ] Recommended immediate, short-term, and long-term mitigations
• [ ] Prioritized top 3-5 abuse cases
• [ ] Provided specific, implementable recommendations

rule_id: secure-flow-detect-secrets

Detect Secrets with Gitleaks

Detect secrets and credentials in your codebase using gitleaks on a selected location. Scan for API keys, passwords, tokens, and other sensitive information that should not be committed to version control.

Prerequisites

• Ensure gitleaks is installed and available in PATH
• Installation: https://github.com/gitleaks/gitleaks#installing
• Verify with: gitleaks version

Running Gitleaks Scan

• Use gitleaks detect command to scan for secrets
• Specify the source directory with --source flag
• Use --report-format json for structured output
• Save report with --report-path flag
• For non-git directories, add --no-git flag
• Use --verbose for detailed output

Basic Scan Command

gitleaks detect --source /path/to/scan --report-format json --report-path gitleaks-report.json

Custom Configuration

• Create a .gitleaks.toml config file for custom rules
• Specify config with --config flag
• Customize rules, allowlists, and ignore patterns
• Example: gitleaks detect --source . --config .gitleaks.toml

Understanding Results

• Gitleaks exit codes:
• 0: No secrets found (success)
• 1: Secrets detected (action required)
• 2: Error occurred during scan
• Review JSON report for detailed findings
• Each finding includes:
• File path and line number
• Secret type and rule ID
• Matched content (redacted in output)
• Commit information (if git repository)

Alerting on Detected Secrets

• Alert the user about any detected secrets
• Display detailed information for each finding:
• File path and line number
• Secret type (Rule ID) and description
• Risk level and impact assessment
• Provide recommendations for remediation (but do NOT execute them)
• Recommend rotating exposed credentials (user must do this manually)
• Suggest using secret management solutions (AWS Secrets Manager, HashiCorp Vault, etc.)
• Do NOT modify, remove, or rotate any code or credentials

CI/CD Integration

• Add gitleaks scan to CI/CD pipeline
• Fail builds when secrets are detected
• Use GitHub Action: gitleaks/gitleaks-action@v2
• Example GitHub Actions workflow:

- name: Gitleaks Scan
  uses: gitleaks/gitleaks-action@v2
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Best Practices

• Run gitleaks before committing code
• Add pre-commit hooks to prevent accidental commits
• Scan entire repository periodically
• Keep gitleaks configuration up to date
• Educate team on secret management
• Use .gitignore for sensitive files

Example Gitleaks Config (.gitleaks.toml)

[extend]
useDefault = true

[allowlist]
description = "Allowlisted files"
paths = [
  '''\.md$''',
  '''go.sum$''',
  '''package-lock\.json$'''
]

[allowlist]
description = "Allowlisted secrets"
regexes = [
  '''EXAMPLE_API_KEY''',
  '''fake-secret-for-testing'''
]

Implementation Checklist

• [ ] Verified gitleaks is installed
• [ ] Identified target directory/path to scan
• [ ] Ran gitleaks detect with appropriate flags
• [ ] Parsed JSON report for findings
• [ ] Displayed summary of detected secrets
• [ ] Listed details for each finding (file, line, type, description)
• [ ] Alerted user about detected secrets
• [ ] Provided recommendations for remediation
• [ ] Saved report file for user review
• [ ] Did NOT modify or remove any code

rule_id: secure-flow-explain-ai-threats

Explain AI Threats

Help perform comprehensive security analysis of AI-powered application components. Identify AI-specific security threats and provide remediation guidance.

AI Security Risk Identification

• Prompt injection: direct user input injection, system prompt override, instruction injection, indirect data/file/API injection, jailbreaking, role-playing
• Data exfiltration: training data extraction, system data leakage, output manipulation
• Insecure plugin/function calls: plugin injection, function call manipulation, plugin security
• Training data extraction: memorization, membership inference, model inversion
• Model manipulation: model poisoning, adversarial examples, model extraction
• Jailbreaking: safety bypass, role manipulation, instruction following
• Prompt leakage: system prompt exposure, prompt reconstruction
• System prompt override: user prompt dominance, instruction injection

Code Analysis

• Input sanitization/validation: prompt construction, user input handling, input validation/sanitization/encoding
• Prompt construction/escaping: system/user prompt construction, prompt escaping/isolation/validation
• Output filtering/sanitization: output filtering/sanitization, sensitive data detection, output validation/encoding
• Plugin/function call validation: call/parameter validation, permission checks, sandboxing/isolation
• Rate limiting/abuse prevention: rate limiting, abuse detection, throttling, cost controls, usage monitoring
• Context isolation: context separation, session/user/data isolation
• User input handling: input validation/sanitization/encoding, length limits, type checking

Remediation Strategies

• Secure prompt engineering: clear prompt structure, instruction separation, input validation, output constraints, safety instructions
• Input/output validation: validate inputs/outputs, type/range/format checking
• Sandboxing/isolation: process/container/network isolation, resource limits, permission restrictions
• Monitoring/detection: anomaly detection, attack detection, pattern analysis, alerting, logging
• Access controls: authentication, authorization, rate limiting, usage quotas, cost controls
• Make analysis practical with real attack examples and concrete fixes
• Focus on actionable remediation
• Show before/after code examples demonstrating secure patterns

Implementation Checklist

• [ ] Identified AI-specific security risks
• [ ] Analyzed prompt injection vulnerabilities
• [ ] Analyzed data exfiltration risks
• [ ] Analyzed plugin/function call security
• [ ] Analyzed input/output validation
• [ ] Analyzed rate limiting and abuse prevention
• [ ] Analyzed context isolation
• [ ] Provided secure prompt engineering strategies
• [ ] Provided sandboxing and isolation recommendations
• [ ] Provided monitoring and detection guidance
• [ ] Showed before/after code examples
• [ ] Focused on actionable remediation

rule_id: secure-flow-fix-exploitable-vulns

Fix Exploitable Vulnerabilities

Fix CISA Known Exploited Vulnerabilities (KEV) if exists in your codebase. Search for vulnerabilities that are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog using Trivy filesystem scanning. If any of these vulnerabilities are found, fix them by the CVE notes.

Trivy Filesystem Scan

• Use only Trivy filesystem scanning via the aquasecurity/trivy-action GitHub Action
• Do not integrate with other security tools
• Configure Trivy to scan the filesystem for vulnerabilities
• Ensure output is in JSON format and saved for the next steps

CISA KEV Catalog Download

• Create a step that downloads the CISA KEV catalog in JSON format
• Use URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

Vulnerability Matching

• Parse the Trivy JSON output to extract CVE IDs
• Match CVE IDs from Trivy output with the CISA KEV catalog
• Use CVE ID from Trivy output to match it with the CISA KEV catalog
• If CVE ID is found in the catalog, the CI/CD should fail and block the commit

Logging and Reporting

• Add detailed logs showing the number of vulnerabilities found
• Display vulnerability details including:
• CVE ID
• CISA Details (Vendor, Product, Vulnerability Name, Due Date, Required Action)
• Affected Packages (Package Name, Current Version, Fixed Version, Severity, Description)
• Show user confidence that the workflow is working

Fix Vulnerabilities

• Use the notes section in the downloaded URL to find out specific info about the vulnerability
• Fix it accordingly

Implementation Checklist

• [ ] Performed Trivy filesystem scan
• [ ] Downloaded CISA KEV catalog
• [ ] Matched CVE IDs from Trivy output with CISA KEV catalog
• [ ] Identified exploited vulnerabilities in codebase
• [ ] Logged vulnerability details (CVE ID, CISA details, affected packages)
• [ ] Reviewed CISA notes for vulnerability-specific information
• [ ] Fixed identified vulnerabilities
• [ ] Verified fixes by re-running Trivy scan

rule_id: secure-flow-gate-critical-vulns

Gate Critical Vulnerabilities

Set up CI/CD checks to block the inclusion of critical vulnerabilities to your codebase. Create or update a CI workflow that runs Trivy filesystem scanning to detect critical vulnerabilities and fail the pipeline if any are introduced.

Workflow Setup

• Check if there is already a Trivy workflow in the repository
• If workflow exists, add the new step to the existing workflow
• If no workflow exists, create a new workflow file
• Configure workflow to run on every PR to the default branch

Trivy Configuration

• Use only Trivy filesystem scanning via the aquasecurity/trivy-action GitHub Action
• Do not integrate with other security tools
• Configure Trivy to scan for critical severity vulnerabilities
• Set workflow to fail if critical vulnerabilities are introduced

Detailed Logging

• Add detailed logging to show the vulnerabilities found
• Display vulnerability details including:
• CVE ID
• Package name and version
• Severity level
• Description
• Fixed version (if available)
• Show user what needs to be updated

Remediation

• If the CI fails due to critical vulnerabilities, patch the dependencies
• Update vulnerable packages to fixed versions
• Ensure the PR is ready to merge after remediation
• Verify the pipeline passes after fixes are applied

Implementation Checklist

• [ ] Checked for existing Trivy workflow in repository
• [ ] Created or updated workflow file
• [ ] Configured Trivy filesystem scan for critical vulnerabilities
• [ ] Set workflow to run on every PR to default branch
• [ ] Added detailed logging for vulnerability details
• [ ] Configured workflow to fail on critical vulnerabilities
• [ ] Tested workflow detects critical vulnerabilities
• [ ] Patched dependencies if vulnerabilities found
• [ ] Verified pipeline passes after remediation

rule_id: secure-flow-harden-dockerfile-fips

Harden Dockerfile for FIPS Compliance

Transform your Docker images to FIPS compliant by removing root users and ensuring security best practices. Make all production docker images in this repository FIPS compliant by hardening Dockerfiles and ensuring they do not run as root users.

FIPS Compliance Requirements Understanding

• FIPS-validated cryptographic modules: Use cryptographic libraries validated by NIST under CMVP
• FIPS-enabled base OS: Start with base images that support FIPS mode:
• Red Hat Enterprise Linux (RHEL) with FIPS mode enabled
• Ubuntu Pro FIPS images
• CentOS Stream with FIPS modules
• SUSE Linux Enterprise with FIPS certification
• FIPS-compliant OpenSSL: Use OpenSSL compiled with FIPS support
• Kernel configuration: Enable FIPS mode in Linux kernel with fips=1 boot parameter

Base Image Selection

• Use certified base images appropriate for the Dockerfile
• Examples:
• FROM registry.redhat.io/ubi8/ubi:latest
• FROM ubuntu:20.04-fips
• Use the most appropriate OS base image for each Dockerfile

FIPS Module Installation

• Install FIPS modules:
• For RHEL/UBI: RUN yum install -y dracut-fips openssl
• Run dracut: RUN dracut -f

FIPS Mode Configuration

• Configure FIPS mode: RUN fips-mode-setup --enable
• Verify compliance: RUN cat /proc/sys/crypto/fips_enabled (should return 1)

Security Hardening

• Remove root user execution
• Create non-root user for application execution
• Apply security best practices to Dockerfiles
• Ensure all production images are hardened

Verification

• Build containers using podman to verify builds work correctly
• Verify FIPS mode is enabled
• Test that applications run correctly with non-root user
• Ensure all production docker images are FIPS compliant

Implementation Checklist

• [ ] Identified all production Dockerfiles in repository
• [ ] Selected appropriate FIPS-enabled base images
• [ ] Installed FIPS modules in Dockerfiles
• [ ] Configured FIPS mode in Dockerfiles
• [ ] Removed root user execution
• [ ] Created non-root users for application execution
• [ ] Applied security best practices
• [ ] Built containers using podman to verify builds
• [ ] Verified FIPS mode is enabled
• [ ] Tested applications run correctly
• [ ] Ensured all production images are FIPS compliant

rule_id: secure-flow-review-api-auth

API Authentication Review

Review API authentication and authorization mechanisms. Find API endpoints on this service that have no authentication attached to them and add authentication where missing.

Endpoint Discovery

• Identify all API endpoints in the service
• Create a comprehensive list of all API endpoints
• Document endpoint locations, methods, and routes

Authentication Mechanism Detection

• Check if the project has any authentication mechanisms
• Identify authentication frameworks, middleware, or libraries in use
• If no authentication mechanisms are found, return a message that no authentication mechanisms were found and do nothing

Endpoint Review

• Review each API endpoint one by one for authentication
• Check if authentication middleware or decorators are applied
• Verify authentication requirements are enforced
• If authentication exists, continue to the next endpoint
• If authentication does not exist, proceed to add authentication

Add Authentication

• Apply appropriate authentication mechanisms to unprotected endpoints
• Use existing authentication framework if available
• Ensure authentication is properly integrated with the endpoint
• Verify authentication requirements are enforced

Verification

• Verify all endpoints have appropriate authentication
• Test authentication works correctly
• Ensure no functionality is broken by authentication changes

Implementation Checklist

• [ ] Created list of all API endpoints
• [ ] Identified authentication mechanisms in the project
• [ ] Reviewed each endpoint for authentication
• [ ] Added authentication to unprotected endpoints
• [ ] Verified authentication is properly enforced
• [ ] Tested authentication functionality
• [ ] Ensured no functionality is broken

rule_id: secure-flow-security-remediation

Security Remediation

Run a security remediation task that checks for vulnerabilities in the codebase and applies necessary fixes. Scan the codebase for vulnerabilities using Trivy and attempt to fix up to 3 vulnerabilities of the highest impact.

Vulnerability Scanning

• Run Trivy filesystem scan on the codebase
• Use command: trivy fs --format json <path to repo directory>
• Parse the JSON output to identify vulnerabilities
• Sort vulnerabilities by impact/severity

Vulnerability Analysis

• Identify the highest impact vulnerabilities
• Select up to 3 vulnerabilities to remediate
• Analyze each vulnerability:
• CVE ID
• Severity level
• Affected package and version
• Available fixed version
• Impact assessment

Remediation Planning

• Determine the fix strategy for each vulnerability
• Check if fixed versions are available
• Plan dependency updates or patches needed
• Consider impact on application functionality

Apply Fixes

• Update vulnerable packages to fixed versions
• Apply patches if available
• Update dependency files (requirements.txt, package.json, etc.)
• Ensure backward compatibility where possible

Verification

• Re-run Trivy scan to verify vulnerabilities are fixed
• Test that application functionality still works
• Verify no new vulnerabilities were introduced
• Document fixes applied

Implementation Checklist

• [ ] Ran Trivy filesystem scan on codebase
• [ ] Parsed Trivy JSON output
• [ ] Identified highest impact vulnerabilities
• [ ] Selected up to 3 vulnerabilities to fix
• [ ] Analyzed each vulnerability's details
• [ ] Planned remediation strategy
• [ ] Updated vulnerable packages to fixed versions
• [ ] Updated dependency files
• [ ] Re-ran Trivy scan to verify fixes
• [ ] Tested application functionality
• [ ] Verified no new vulnerabilities introduced
• [ ] Documented fixes applied

rule_id: secure-flow-validate-compliance

Validate Compliance

Help validate the current code context against compliance requirements (SOC 2, ISO 27001, NIST, GDPR, HIPAA, PCI DSS). Identify gaps, validate controls, and provide remediation guidance.

Compliance Framework Identification

• Identify applicable frameworks: SOC 2, ISO 27001, NIST CSF, GDPR, HIPAA, PCI DSS, FedRAMP, CCPA, CIS Controls
• Understand application type, data types, deployment environment, and geographic scope

Compliance Control Validation

• Access control: MFA, RBAC, least privilege, session management
• Encryption: HTTPS/TLS, data at rest, key management
• Logging: security events, audit trails, retention
• Configuration: debug mode, security headers, CORS, secrets
• Vulnerability management: scanning, patching, remediation
• Data privacy: data minimization, consent, PII handling
• Incident response: detection, response plan, escalation
• Business continuity: backups, recovery procedures

Code Context Analysis

• Analyze authentication, authorization, encryption, logging, configuration, error handling, input validation, session management, and secret management
• Compare against requirements and identify:
• Missing controls
• Inadequate controls
• Misconfigured controls
• Non-compliant code

Compliance Validation Report

• Executive summary: status, findings count, compliance score, recommendations
• Framework-specific validation: control status, evidence, gaps, recommendations
• Detailed findings: severity, location, impact, remediation steps
• Prioritized remediation roadmap: P0-P3
• Generate actionable compliance validation with specific code locations, before/after examples, and prioritized remediation steps

Implementation Checklist

• [ ] Identified applicable compliance frameworks
• [ ] Validated access control and authentication
• [ ] Validated encryption and key management
• [ ] Validated logging and audit trails
• [ ] Validated configuration security
• [ ] Validated vulnerability management
• [ ] Validated data privacy controls
• [ ] Validated incident response procedures
• [ ] Validated business continuity
• [ ] Analyzed code context for compliance gaps
• [ ] Generated compliance validation report
• [ ] Provided prioritized remediation roadmap