Sup Standards

sup-standards

Org-wide engineering standards for Superbalist, packaged as a Claude Code plugin. Maintained by Platform Engineering.

Version: 0.1.0

What's inside

Type	Name	What it does
Skill	conventional-commit	Teaches Claude to write Conventional Commits 1.0.0 messages — correct type(scope): subject, imperative subjects, wrapped bodies, BREAKING CHANGE footers. Triggers when you draft or reword a commit.
Skill	secure-coding-review	A framework-agnostic security checklist (input validation, authn/authz, secrets, injection, unsafe deserialization, dependency risk). Triggers when reviewing code for security.
Command	/pr-description	Reads the branch/staged diff and produces a PR description with Summary, Changes, Testing, and Risk sections.
Agent	code-reviewer	A read-only subagent that reviews a diff for correctness, security, and standards adherence, returning findings grouped by severity. It never modifies files.
Hook	block-secrets	A PreToolUse hook that scans Write/Edit/MultiEdit content and blocks the change if it contains obvious secrets.

The secret-blocking hook

hooks/block-secrets.sh runs before every file write or edit. It scans the proposed content for high-signal secret patterns:

• AWS access key IDs (AKIA…) and secret-key assignments
• Private key headers (-----BEGIN … PRIVATE KEY-----)
• GitHub and Slack tokens
• High-entropy values assigned to variables named secret, token, password, or api_key

On a match it blocks the edit and explains what matched. It is non-destructive — it only reads the payload and prints a message; it never deletes or rewrites anything.

Overriding the hook

If you hit a genuine false positive (for example, a documented test fixture), set the escape-hatch environment variable for that session:

export ALLOW_SECRET=1

To disable the hook entirely, disable the plugin (or remove the hooks block); prefer the scoped ALLOW_SECRET=1 override instead.

Updating this plugin

Every change must bump version in .claude-plugin/plugin.json (semver) and add an entry to CHANGELOG.md. See the repo-root CONTRIBUTING.md for the full workflow.