dev-ruleslisted

# Development Rules and Guardrails ## Git Safety | Rule | Why | |------|-----| | Never force push to main/master | Destroys team history, breaks CI | | Never `git reset --hard` without confirmation | Irreversible data loss | | Never amend published commits | Creates divergent history for collaborators | | Never skip pre-commit hooks (`--no-verify`) | Hooks catch real issues | | Stage specific files by name | `git add .` risks committing secrets or binaries | | Never commit .env, credentials, API keys | Secrets in git history are permanent | | Verify current branch before pushing | Avoid pushing to wrong branch | ## Security ### Secrets and Credentials - Never commit `.env` files, API keys, tokens, passwords, or connection strings - Always use `.env.example` with placeholder values, never real credentials - If real credentials are found in git history, flag immediately - they must be rotated - Add secret config files to `.gitignore` (e.g., `config/secrets.yml`) ### Code Security - Validate all user input at system boundaries (API endpoints, form submissions) - Use parameterized queries - never string concatenation for database queries - Sanitize data before rendering in templates (prevent XSS) - Use bcrypt or argon2 for password hashing, never MD5 or SHA for passwords - Set CORS origins from environment variables, never wildcard in production ### Dependency Security - Check for known vulnerabilities before adding new packages - Prefer well-maintained packages with active