Standards: Security Policies, Language-Specific Security Rules, and Disclosure Endpoints

Overview

This section documents the project's security disclosure surface and the source-backed security rule sets that apply across languages. The repository splits policy into a central security policy, a public marketplace disclosure endpoint, a marketplace policy page, and language-specific markdown rules that reinforce secure coding and secret handling.

Security Disclosure and Policy Surface

SECURITY.md

SECURITY.md is the project's main vulnerability disclosure policy:

The policy explicitly asks reporters not to use public GitHub issues for security bugs.

Marketplace disclosure endpoint

marketplace/public/.well-known/security.txt:

Marketplace security policy page

marketplace/public/legal/security-policy.html is the marketplace-facing security policy landing page (marked noindex). Questions go to legal@paxeer.app.

Common Security Rules

rules/common/security.md defines the baseline security checks required before any commit:

Language-Specific Security Rules

Web

rules/web/security.md extends the shared guidance with browser-specific security. It requires a production CSP and recommends a per-request nonce for scripts instead of 'unsafe-inline'.

Go

rules/golang/security.md applies the shared security policy to **/*.go, **/go.mod, and **/go.sum.

TypeScript

rules/typescript/security.md applies the shared policy to TypeScript, JavaScript, and JSX/TSX. It forbids hardcoded API keys and shows environment-variable-based configuration using process.env.OPENAI_API_KEY with a fail-fast Error when the key is missing.

Python

rules/python/security.md applies the shared policy to **/*.py and **/*.pyi.

Java

rules/java/security.md forbids hardcoded secrets, recommends System.getenv("API_KEY"), advises using a secret manager for production, and keeps local configuration out of version control. Includes an input-validation example through createOrder where blank customer names and nonpositive amounts raise IllegalArgumentException.

Kotlin

rules/kotlin/security.md directs contributors to keep secrets in local.properties, use BuildConfig for CI-injected release values, and store runtime secrets in EncryptedSharedPreferences or Keychain. Additional requirements:

• Store tokens in secure storage rather than plain SharedPreferences.
• Implement token refresh with proper 401 and 403 handling.
• Clear auth state on logout.
• Use BiometricPrompt for sensitive operations.
• Keep ProGuard or R8 rules for serialized and reflection-based libraries.
• Validate URLs and control navigation in WebView usage.
• Disable JavaScript unless explicitly needed.

Rust

rules/rust/security.md forbids hardcoded secrets, uses std::env::var("API_KEY")-style loading, fails fast when required secrets are missing, and keeps .env files out of version control. Includes an Email::parse example with trimmed input validation, @ location check, length and domain checks, and typed validation errors. Server-side logging guidance: use tracing or log, keep detailed errors on the server, return generic messages to clients.

Swift

rules/swift/security.md requires Keychain Services for sensitive data, recommends environment variables or .xcconfig files for build-time secrets, and forbids hardcoding secrets in source.

PHP

rules/php/security.md focuses on request validation at the framework boundary, output escaping by default, prepared statements for all dynamic queries, secrets loaded from environment variables or a secret manager, and CSRF protection for state-changing requests. It also adds dependency review with composer audit and warns against abandoned packages.

Perl

rules/perl/security.md requires taint mode for CGI or web-facing scripts, sanitization of %ENV before external commands, and allowlist-based regex untainting.

C#

rules/csharp/security.md forbids hardcoded API keys, tokens, and connection strings. Developers use environment variables, user secrets for local development, and secret managers in production. Includes configuration validation that throws InvalidOperationException when a required setting is missing and parameterized SQL through QueryAsync<Order> with named parameters.

C++

rules/cpp/security.md emphasizes memory safety, buffer-overflow prevention, and undefined-behavior avoidance:

Dart

rules/dart/security.md forbids hardcoded secrets in Dart source, recommends --dart-define or --dart-define-from-file for compile-time config, and uses flutter_dotenv for non-secret configuration. Runtime secret storage goes to flutter_secure_storage. Mobile hardening:

• Review required permissions in AndroidManifest.xml.
• Export Android components only when necessary.
• Use android:exported="false" when possible.
• Review implicit intent filters.
• Use FLAG_SECURE for sensitive screens.
• Keep ProGuard or R8 rules in sync with release behavior.
• Run flutter analyze and address warnings before release.

Chinese mirror

rules/zh/security.md restates the shared security checklist, secret management guidance, and response protocol in Chinese.

Key Files Reference