Generate comprehensive secure coding guidelines customized by language, framework, and compliance requirements for development teams.
You are a secure software development expert. Generate coding guidelines for a development team. ## Team Configuration - **Primary Language**: [LANGUAGE e.g. Python / Java / C# / TypeScript / Go / Rust] - **Framework**: [FRAMEWORK e.g. Django / Spring Boot / ASP.NET / Next.js / Gin] - **Application Type**: [APP_TYPE e.g. web API / mobile backend / microservices / serverless] - **Compliance**: [COMPLIANCE e.g. OWASP ASVS Level 2 / PCI-DSS / HIPAA / none] - **Team Experience**: [EXPERIENCE e.g. junior-heavy / mixed / senior] ## Guidelines Sections ### 1. Input Validation - Whitelist validation approach: define allowed characters, lengths, patterns - Framework-specific validation: [FRAMEWORK] built-in validators - File upload validation: type, size, content verification - API request validation: schema validation with OpenAPI/JSON Schema - Code examples for [LANGUAGE]: - Safe string handling - Parameterized queries (never string concatenation) - Path validation and sandboxing - URL validation and SSRF prevention ### 2. Authentication & Session Management - Password requirements and hashing (Argon2id parameters for [LANGUAGE]) - Session token generation and management in [FRAMEWORK] - Multi-factor authentication integration - Remember-me functionality (secure implementation) - Account lockout and brute force protection - Code examples for each pattern ### 3. Authorization - Role-based access control (RBAC) implementation in [FRAMEWORK] - Attribute-based access control (ABAC) patterns - Resource-level authorization checks - API endpoint authorization middleware - Anti-IDOR patterns with indirect references ### 4. Data Protection - Encryption at rest: recommended libraries for [LANGUAGE] - Encryption in transit: TLS configuration - Sensitive data handling: PII, credentials, tokens - Data masking in logs and error messages - Secure deletion procedures ### 5. Error Handling & Logging - Safe error responses: no stack traces, no internal details - Structured logging format with security events - What to log: authentication events, authorization failures, input validation failures - What NOT to log: passwords, tokens, PII, credit card numbers - Correlation IDs for request tracing ### 6. Dependency Management - Dependency scanning in CI/CD pipeline - Lock file usage and verification - Private registry configuration - Automated update strategy - License compliance checking ### 7. Code Review Checklist - Security-focused review checklist for PRs - Common vulnerability patterns to check - Automated checks with linting rules - [FRAMEWORK]-specific security configurations ### 8. Testing Requirements - Security unit test patterns for [LANGUAGE] - Integration test scenarios for auth flows - Negative test cases: invalid inputs, unauthorized access - DAST integration in CI pipeline Format as a living document with version tracking, organized by severity priority for [EXPERIENCE] level teams.
Free to copy and use. Compatible with Claude 4 Opus, GPT-5, Gemini 2.0 Flash, Llama 4 Maverick.
Specify your team's language, framework, and compliance requirements. Distribute the generated guidelines to all developers. Integrate the code review checklist into your PR process. Update quarterly.
Initial release
Sign in and download this prompt to leave a review.