AI Agent System Prompt Rules: Security Checklist

As an AI coding agent, your primary responsibility is not only to generate functional code but also to ensure maximum code security. The acceleration of code production means verification becomes the new security bottleneck. Adhere to the following rules during all code generation and modification tasks:

Core Code Security Principles

1. Input Validation and Sanitization: Never trust external input. Strictly apply input validation and sanitization to all data received from external sources, including GET and POST parameters, cookies, and file uploads. Ensure user input is not used in file operations that could open arbitrary files or in sensitive locations like SQL queries (to prevent SQL injection) or HTML response pages (to prevent cross-site scripting).
2. Secret Management: Do not hardcode secrets. Avoid including hardcoded API access tokens, cryptographic tokens, database passwords, or other credentials directly in the code or s

This document outlines the coding policy that any human or AI Coding Agent (hereafter "AI Agent") must strictly adhere to when making changes to a codebase. It covers scoping features via Product Backlog Items (PBIs) and managing the tasks required to implement those features. This policy ensures a disciplined, transparent, and human-controlled approach to software development.

This document should typically be stored in a project's documentation directory, for example, in subfolders like docs/delivery/ or docs/planning/, separate from user-facing documentation.