Security Patterns - Kailash SDK

Mandatory security patterns for all Kailash SDK development. These patterns prevent common vulnerabilities and ensure secure application development.

Overview

Security patterns cover:

• Secret management (no hardcoded credentials)
• Input validation (prevent injection attacks)
• Authentication and authorization
• OWASP Top 10 prevention
• Secure API design
• Environment variable handling

Critical Rules

1. NEVER Hardcode Secrets

# ❌ WRONG - Hardcoded credentials
api_key = "sk-1234567890abcdef"
db_password = "mypassword123"

# ✅ CORRECT - Environment variables
import os
api_key = os.environ["API_KEY"]
db_password = os.environ["DATABASE_PASSWORD"]

2. Validate All User Inputs

# ❌ WRONG - No validation
def process_user_input(user_data):
    return db.execute(f"SELECT * FROM users WHERE id = {user_data}")

# ✅ CORRECT - Parameterized queries (via DataFlow)
workflow.add_node("User_Read", "read_user", {
    "id": validated_user_id  # DataFlow handles parameterization
})

3. Use HTTPS for API Calls

# ❌ WRONG - HTTP in production
workflow.add_node("HTTPRequestNode", "api", {
    "url": "http://api.example.com/data"  # Insecure!
})

# ✅ CORRECT - HTTPS always
workflow.add_node("HTTPRequestNode", "api", {
    "url": "https://api.example.com/data"
})

Reference Documentation

Core Security

• security-secrets - Secret management patterns
• security-input-validation - Input validation
• security-injection-prevention - SQL/code injection prevention

Authentication & Authorization

• security-auth-patterns - Auth best practices
• security-api-keys - API key management
• security-tokens - Token handling

OWASP Compliance

• security-owasp-top10 - OWASP Top 10 prevention
• security-audit-checklist - Security audit checklist

Security Checklist

Before Every Commit

• No hardcoded secrets (API keys, passwords, tokens)
• All user inputs validated
• SQL/code injection prevented
• HTTPS used for all API calls
• Sensitive data not logged
• Error messages don't expose internals

Before Every Deployment

• Environment variables configured
• Secrets stored in secure vault
• Authentication enabled
• Authorization rules defined
• OWASP Top 10 checked
• Security review completed

SSRF Prevention (Webhook/Outbound HTTP)

When making outbound HTTP requests to user-supplied URLs:

1. Validate URL scheme — only http:// and https://
2. Resolve DNS and check IP — block RFC 1918, loopback, link-local, cloud metadata
3. Check IPv4-mapped IPv6 — ::ffff:127.0.0.1 bypasses IPv4-only blocklists. Extract the mapped IPv4 address and re-validate
4. Pin resolved IP — replace hostname with resolved IP in the URL to prevent DNS rebinding. Set Host header to original hostname
5. Block 0.0.0.0/8 — routes to localhost on some systems

Reference implementation: See the Nexus webhook transport source for a working _validate_target_url() pattern.

Error Message Security

Never return raw exception messages to clients — they leak file paths, class names, database URLs.

# ❌ WRONG — leaks internals
return {"error": str(exception)}

# ✅ CORRECT — log internally, return generic message
log_exception("Operation failed")
return {"error": "Internal server error"}

Common Vulnerabilities Prevented

Integration with Rules

Security patterns are enforced by:

• .claude/rules/security.md - Security rules
• scripts/hooks/validate-bash-command.js - Command validation
• gold-standards-validator agent - Compliance checking

When to Use This Skill

Use this skill when:

• Handling user input or external data
• Storing or transmitting credentials
• Making API calls to external services
• Implementing authentication/authorization
• Conducting security reviews
• Preparing for deployment

Related Skills

• 17-gold-standards - Mandatory best practices
• 16-validation-patterns - Validation patterns
• 01-core-sdk - Core workflow patterns

Support

For security-related questions, invoke:

• security-reviewer - OWASP-based security analysis
• gold-standards-validator - Compliance checking
• testing-specialist - Security testing patterns