Coding Standards, Security, and Contributor Policy

Overview

This section documents the project’s security disclosure surface and the source-backed security rule sets that apply across languages. The repository splits policy into a central security policy, a public marketplace disclosure endpoint, a marketplace policy page, and language-specific markdown rules that reinforce secure coding and secret handling.

The material is intentionally operational: it tells reporters where to send vulnerabilities, shows what is in scope, and captures the concrete guardrails contributors are expected to follow before committing code. It also includes localized security guidance in Chinese and a web-specific CSP rule set for browser-delivered content.

Security Disclosure and Policy Surface

SECURITY.md

SECURITY.md

SECURITY.md is the project’s main vulnerability disclosure policy. It defines supported versions, in-scope and out-of-scope areas, the preferred report channels, the expected response timeline, and a set of operator hardening notes that describe security invariants enforced in code.

Disclosure flow

marketplace/public/.well-known/security.txt

The policy explicitly asks reporters not to use public GitHub issues for security bugs.

marketplace/public/.well-known/security.txt

This is the public disclosure endpoint for the marketplace. It advertises a security contact address, an expiry, a preferred language, and canonical references back to the marketplace-hosted policy documents.

marketplace/public/legal/security-policy.html

marketplace/public/legal/security-policy.html

This page is the marketplace-facing security policy landing page. It is marked noindex, titled Security Policy · Deus, and currently presents a placeholder statement telling visitors that the final policy will replace the file at the same URL before public launch.

The visible UI links to mailto:legal@paxeer.app for questions and a root-relative link back to the marketplace.

Common Security Rules

rules/common/security.md

This file explicitly states that it is a placeholder and that the final policy will replace the same URL before public launch.

rules/common/security.md

This file defines the baseline security checks that apply before any commit. It is the shared rule set that the language-specific documents extend.

Language-Specific Security Rules

rules/web/security.md

rules/web/security.md

This rule set extends the shared guidance with web-specific browser security. It requires a production CSP and recommends a per-request nonce for scripts instead of 'unsafe-inline'.

rules/golang/security.md

rules/golang/security.md

This rule set applies the shared security policy to Go source and module manifests. Its coverage is tied to **/*.go, **/go.mod, and **/go.sum, and it is explicitly an extension of the common security rules.

rules/typescript/security.md

rules/typescript/security.md

This rule set applies the shared security policy to TypeScript, JavaScript, and JSX/TSX files. It forbids hardcoded API keys and shows environment-variable-based configuration using process.env.OPENAI_API_KEY with a fail-fast Error when the key is missing.

rules/python/security.md

rules/python/security.md

This rule set applies the shared security policy to Python source and type stub files. Its scope is tied to **/*.py and **/*.pyi, and it extends the common security rules for Python code.

rules/java/security.md

rules/java/security.md

This rule set applies the shared security policy to Java source. It forbids hardcoded secrets, recommends System.getenv("API_KEY"), advises using a secret manager for production, and keeps local configuration out of version control.

It also includes an input-validation example through createOrder, where blank customer names and nonpositive amounts raise IllegalArgumentException.

rules/kotlin/security.md

rules/kotlin/security.md

This rule set applies the shared security policy to Kotlin and Android or KMP code. It directs contributors to keep secrets in local.properties, use BuildConfig for CI-injected release values, and store runtime secrets in EncryptedSharedPreferences or Keychain.

It also specifies security handling for authenticated clients and mobile surfaces:

• store tokens in secure storage rather than plain SharedPreferences
• implement token refresh with proper 401 and 403 handling
• clear auth state on logout
• use BiometricPrompt for sensitive operations
• keep ProGuard or R8 rules for serialized and reflection-based libraries
• validate URLs and control navigation in WebView usage
• disable JavaScript unless explicitly needed

rules/rust/security.md

rules/rust/security.md

This rule set applies the shared security policy to Rust source. It forbids hardcoded secrets, uses std::env::var("API_KEY")-style loading, fails fast when required secrets are missing, and keeps .env files out of version control.

It also includes an Email::parse example that validates trimmed input, checks the @ location, applies length and domain checks, and returns a typed validation error on malformed input. Server-side logging guidance is also explicit: use tracing or log, keep detailed errors on the server, and return generic messages to clients.

rules/swift/security.md

rules/swift/security.md

This rule set applies the shared security policy to Swift source and package manifests. It requires Keychain Services for sensitive data, recommends environment variables or .xcconfig files for build-time secrets, and forbids hardcoding secrets in source.

rules/php/security.md

rules/php/security.md

This rule set applies the shared security policy to PHP code and package manifests. It focuses on request validation at the framework boundary, output escaping by default, prepared statements for all dynamic queries, secrets loaded from environment variables or a secret manager, and CSRF protection for state-changing requests.

It also adds operational guidance around dependency review with composer audit and warns against abandoned packages. The rule set references laravel-security for Laravel-specific guidance.

rules/perl/security.md

rules/perl/security.md

This rule set applies the shared security policy to Perl code and tests. It requires taint mode for CGI or web-facing scripts, sanitization of %ENV before external commands, and allowlist-based regex untainting rather than permissive capture patterns.

rules/csharp/security.md

rules/csharp/security.md

This rule set applies the shared security policy to C# source, scripts, project files, and application settings files. It forbids hardcoded API keys, tokens, and connection strings, and directs developers to use environment variables, user secrets for local development, and secret managers in production.

It also shows configuration validation that throws InvalidOperationException when a required setting is missing, and it demonstrates parameterized SQL through a QueryAsync<Order> call with a named parameter.

rules/cpp/security.md

rules/cpp/security.md

This rule set applies the shared security policy to C++ source and CMake files. It emphasizes memory safety, buffer-overflow prevention, and undefined-behavior avoidance.

rules/dart/security.md

rules/dart/security.md

This rule set applies the shared security policy to Dart, Flutter, Android, and iOS mobile code. It forbids hardcoded secrets in Dart source, recommends --dart-define or --dart-define-from-file for compile-time config, and uses flutter_dotenv or equivalent for non-secret configuration.

It also directs runtime secret storage into secure storage such as flutter_secure_storage, and it adds mobile hardening guidance:

• review required permissions in AndroidManifest.xml
• export Android components only when necessary
• use android:exported="false" when possible
• review implicit intent filters
• use FLAG_SECURE for sensitive screens
• keep ProGuard or R8 rules in sync with release behavior
• run flutter analyze and address warnings before release

rules/zh/security.md

rules/zh/security.md

This file is the Chinese-language version of the shared security rules. It mirrors the common security checklist, secret management guidance, and response protocol in Chinese so contributors can follow the same security requirements in a localized format.

Key Files Reference