@schneiderjoseph/devia 0.1.0

package/rules/privacy/PRIV-002.md

@@ -0,0 +1,44 @@
+---
+id: PRIV-002
+title: Retention and deletion are defined and implemented
+severity: MUST
+status: active
+domain: privacy
+priority: P1
+source:
+  - GDPR principles
+applies_to:
+  - database
+  - service
+success_criteria:
+  []
+requirement: >
+  Every category of personal data MUST have a retention period and a mechanism that actually enforces it, including backups and logs.
+validation:
+  automated: false
+  manual: true
+exceptions: documented-only
+---
+
+# PRIV-002 — Retention and deletion are defined and implemented
+
+**Requirement:** Every category of personal data MUST have a retention period and a mechanism that actually enforces it, including backups and logs.
+
+**Bad:** A retention policy in a document, with data kept forever in practice.
+
+**Good:** A scheduled job that removes or anonymises expired data, with the policy recorded next to it.
+
+## Validation
+
+- Retention documented per category
+- The job exists and has run
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P1`
+- Exceptions: `documented-only`
+
+## See also
+
+- [DATA_RETENTION.md](../../standard/engineering/compliance/DATA_RETENTION.md)

package/rules/privacy/PRIV-003.md

@@ -0,0 +1,40 @@
+---
+id: PRIV-003
+title: Users can obtain and erase their data
+severity: MUST
+status: active
+domain: privacy
+priority: P1
+source:
+  - GDPR principles
+applies_to:
+  - api
+  - service
+success_criteria:
+  []
+requirement: >
+  Where the product holds personal data, an export path and an erasure path MUST exist, MUST be authenticated, and MUST state what erasure cannot remove and why.
+validation:
+  automated: false
+  manual: true
+exceptions: documented-only
+---
+
+# PRIV-003 — Users can obtain and erase their data
+
+**Requirement:** Where the product holds personal data, an export path and an erasure path MUST exist, MUST be authenticated, and MUST state what erasure cannot remove and why.
+
+**Bad:** Support deletes rows by hand on request, differently each time.
+
+**Good:** A tested export and an erasure flow that names its exceptions (legal retention, audit trail).
+
+## Validation
+
+- Both flows exist and are tested
+- Exceptions documented
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P1`
+- Exceptions: `documented-only`

package/rules/privacy/PRIV-004.md

@@ -0,0 +1,41 @@
+---
+id: PRIV-004
+title: Personal data stays out of logs, analytics and prompts
+severity: MUST
+status: active
+domain: privacy
+priority: P1
+source:
+  - GDPR principles
+applies_to:
+  - service
+  - web
+  - ai
+success_criteria:
+  []
+requirement: >
+  Personal data MUST NOT be sent to logs, analytics, third-party tools or model providers unless that transfer is a recorded decision with a lawful basis and a data agreement.
+validation:
+  automated: true
+  manual: true
+exceptions: documented-only
+---
+
+# PRIV-004 — Personal data stays out of logs, analytics and prompts
+
+**Requirement:** Personal data MUST NOT be sent to logs, analytics, third-party tools or model providers unless that transfer is a recorded decision with a lawful basis and a data agreement.
+
+**Bad:** Full customer records pasted into a model prompt for summarisation.
+
+**Good:** Identifiers are pseudonymised; the transfer, if needed, is recorded and minimised.
+
+## Validation
+
+- Grep the diff for personal fields crossing a boundary
+- The transfer is recorded
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P1`
+- Exceptions: `documented-only`

package/rules/responsive/RWD-001.md

@@ -0,0 +1,40 @@
+---
+id: RWD-001
+title: Touch targets adequate
+severity: MUST
+status: active
+priority: P1
+domain: responsive
+source:
+  - WCAG-2.2
+applies_to:
+  - touch
+  - mobile
+  - tablet
+success_criteria:
+  []
+requirement: >
+  Primary touch targets MUST be comfortably tappable; meet A11Y-010 at minimum.
+validation:
+  automated: false
+  manual: true
+exceptions: documented-only
+---
+
+# RWD-001 — Touch targets adequate
+
+**Requirement:** Primary touch targets MUST be comfortably tappable; meet A11Y-010 at minimum.
+
+**Bad:** Dense icon row unusable on phone.
+
+**Good:** 44×44 primary actions; spacing between targets.
+
+## Validation
+
+- Design or engineering review
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P1`
+- Exceptions: `documented-only`

package/rules/responsive/RWD-002.md

@@ -0,0 +1,39 @@
+---
+id: RWD-002
+title: Core flows at 320px
+severity: MUST
+status: active
+priority: P0
+domain: responsive
+source:
+  - WCAG-2.2
+applies_to:
+  - mobile
+  - web
+success_criteria:
+  - "1.4.10"
+requirement: >
+  Core flows MUST be usable without horizontal page scrolling at 320 CSS px (except intentional overflow with accessible alternative).
+validation:
+  automated: false
+  manual: true
+exceptions: documented-only
+---
+
+# RWD-002 — Core flows at 320px
+
+**Requirement:** Core flows MUST be usable without horizontal page scrolling at 320 CSS px (except intentional overflow with accessible alternative).
+
+**Bad:** Login requires horizontal scroll.
+
+**Good:** Stacked form layout.
+
+## Validation
+
+- Design or engineering review
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P0`
+- Exceptions: `documented-only`

package/rules/responsive/RWD-003.md

@@ -0,0 +1,39 @@
+---
+id: RWD-003
+title: Hover not the only path
+severity: MUST
+status: active
+priority: P0
+domain: responsive
+source:
+  - WCAG-2.2
+applies_to:
+  - desktop
+  - touch
+success_criteria:
+  - "2.5.1"
+requirement: >
+  Functionality revealed only on hover MUST have a keyboard/touch equivalent.
+validation:
+  automated: false
+  manual: true
+exceptions: documented-only
+---
+
+# RWD-003 — Hover not the only path
+
+**Requirement:** Functionality revealed only on hover MUST have a keyboard/touch equivalent.
+
+**Bad:** Delete only appears on row hover.
+
+**Good:** Always-visible overflow menu or focus-revealed actions.
+
+## Validation
+
+- Design or engineering review
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P0`
+- Exceptions: `documented-only`

package/rules/security/SEC-001.md

@@ -0,0 +1,44 @@
+---
+id: SEC-001
+title: Server-side authorization on every sensitive operation
+severity: MUST
+status: active
+domain: security
+priority: P0
+source:
+  - OWASP ASVS 5.0 V4
+applies_to:
+  - api
+  - service
+success_criteria:
+  []
+requirement: >
+  Every operation that reads or changes data belonging to a user, tenant or role MUST verify authorization on the server, on every request, from the session identity — never from a client-supplied identifier.
+validation:
+  automated: false
+  manual: true
+exceptions: none
+---
+
+# SEC-001 — Server-side authorization on every sensitive operation
+
+**Requirement:** Every operation that reads or changes data belonging to a user, tenant or role MUST verify authorization on the server, on every request, from the session identity — never from a client-supplied identifier.
+
+**Bad:** The endpoint trusts `userId` from the request body, or the UI simply hides the button.
+
+**Good:** The handler derives the actor from the session and checks the actor's right to that resource before doing anything.
+
+## Validation
+
+- Test: actor A cannot reach actor B's resource
+- Test: role without permission gets 403, not 200
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P0`
+- Exceptions: `none`
+
+## See also
+
+- [AUTHORIZATION.md](../../standard/engineering/security/AUTHORIZATION.md)

package/rules/security/SEC-002.md

@@ -0,0 +1,44 @@
+---
+id: SEC-002
+title: No secrets in source, config, logs or client bundles
+severity: MUST NOT
+status: active
+domain: security
+priority: P0
+source:
+  - OWASP ASVS 5.0 V14
+applies_to:
+  - repository
+success_criteria:
+  []
+requirement: >
+  Credentials, API keys, tokens and private keys MUST NOT be committed, embedded in a client bundle, printed in logs, or pasted into an issue, prompt or transcript.
+validation:
+  automated: true
+  manual: true
+exceptions: none
+---
+
+# SEC-002 — No secrets in source, config, logs or client bundles
+
+**Requirement:** Credentials, API keys, tokens and private keys MUST NOT be committed, embedded in a client bundle, printed in logs, or pasted into an issue, prompt or transcript.
+
+**Bad:** `STRIPE_SECRET_KEY` in a `.env` that is committed, or echoed by a debug log line.
+
+**Good:** Secrets come from the platform secret store at runtime; `.env.example` holds names, never values.
+
+## Validation
+
+- Secret scan in CI
+- Grep the client bundle for key patterns
+- Rotate any secret that ever touched the repository
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P0`
+- Exceptions: `none`
+
+## See also
+
+- [SECRETS.md](../../standard/engineering/security/SECRETS.md)

package/rules/security/SEC-003.md

@@ -0,0 +1,41 @@
+---
+id: SEC-003
+title: External input is validated before use
+severity: MUST
+status: active
+domain: security
+priority: P0
+source:
+  - OWASP ASVS 5.0 V5
+applies_to:
+  - api
+  - service
+  - web
+success_criteria:
+  []
+requirement: >
+  Every input crossing a trust boundary — request bodies, query strings, headers, webhooks, uploads, third-party responses, model output — MUST be validated against an explicit schema and rejected when it does not match.
+validation:
+  automated: true
+  manual: true
+exceptions: none
+---
+
+# SEC-003 — External input is validated before use
+
+**Requirement:** Every input crossing a trust boundary — request bodies, query strings, headers, webhooks, uploads, third-party responses, model output — MUST be validated against an explicit schema and rejected when it does not match.
+
+**Bad:** `JSON.parse(body)` is passed straight to an ORM write.
+
+**Good:** The body is parsed into a declared schema; unknown fields are rejected; types and ranges are enforced.
+
+## Validation
+
+- Every new endpoint has a schema
+- Test: malformed and oversized input is rejected
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P0`
+- Exceptions: `none`

package/rules/security/SEC-004.md

@@ -0,0 +1,40 @@
+---
+id: SEC-004
+title: Internal error detail never reaches a production client
+severity: MUST
+status: active
+domain: security
+priority: P0
+source:
+  - OWASP ASVS 5.0 V7
+applies_to:
+  - api
+  - web
+success_criteria:
+  []
+requirement: >
+  Stack traces, SQL text, file paths, internal hostnames and framework diagnostics MUST NOT be returned to clients in production. The client gets a stable code and a human-readable message; the detail goes to the log.
+validation:
+  automated: true
+  manual: true
+exceptions: none
+---
+
+# SEC-004 — Internal error detail never reaches a production client
+
+**Requirement:** Stack traces, SQL text, file paths, internal hostnames and framework diagnostics MUST NOT be returned to clients in production. The client gets a stable code and a human-readable message; the detail goes to the log.
+
+**Bad:** A 500 response containing the query and the table name.
+
+**Good:** `{ "error": "payment_failed", "message": "We could not process this payment." }` plus a correlated log entry.
+
+## Validation
+
+- Test an error path against the production configuration
+- Confirm the error handler is the last middleware
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P0`
+- Exceptions: `none`

package/rules/security/SEC-005.md

@@ -0,0 +1,42 @@
+---
+id: SEC-005
+title: Tenant and user isolation is enforced and tested
+severity: MUST
+status: active
+domain: security
+priority: P0
+source:
+  - OWASP ASVS 5.0 V4
+applies_to:
+  - api
+  - service
+  - database
+success_criteria:
+  []
+requirement: >
+  Every query touching user- or tenant-scoped data MUST be constrained by the actor's scope, and that constraint MUST be covered by a test that fails when the constraint is removed.
+validation:
+  automated: false
+  manual: true
+exceptions: none
+---
+
+# SEC-005 — Tenant and user isolation is enforced and tested
+
+**Requirement:** Every query touching user- or tenant-scoped data MUST be constrained by the actor's scope, and that constraint MUST be covered by a test that fails when the constraint is removed.
+
+**Bad:** A list endpoint filters by tenant in the UI only.
+
+**Good:** The query carries the tenant predicate (or a row-level policy does), and a test proves cross-tenant reads return nothing.
+
+## Validation
+
+- Cross-tenant read test
+- Cross-tenant write test
+- Test fails if the predicate is deleted
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P0`
+- Exceptions: `none`

package/rules/security/SEC-006.md

@@ -0,0 +1,40 @@
+---
+id: SEC-006
+title: Sessions expire, rotate and can be revoked
+severity: MUST
+status: active
+domain: security
+priority: P1
+source:
+  - OWASP ASVS 5.0 V3
+applies_to:
+  - api
+  - web
+success_criteria:
+  []
+requirement: >
+  Sessions and tokens MUST have a bounded lifetime, MUST be rotated on privilege change, and MUST be revocable server-side. Logout MUST invalidate server state, not only client storage.
+validation:
+  automated: false
+  manual: true
+exceptions: documented-only
+---
+
+# SEC-006 — Sessions expire, rotate and can be revoked
+
+**Requirement:** Sessions and tokens MUST have a bounded lifetime, MUST be rotated on privilege change, and MUST be revocable server-side. Logout MUST invalidate server state, not only client storage.
+
+**Bad:** A signed token valid for a year with no revocation list.
+
+**Good:** Short-lived access token, rotating refresh token, revocation on logout and on password change.
+
+## Validation
+
+- Test: a revoked session is rejected
+- Test: privilege change invalidates the old session
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P1`
+- Exceptions: `documented-only`

package/rules/security/SEC-007.md

@@ -0,0 +1,44 @@
+---
+id: SEC-007
+title: Webhooks are verified and replay-protected
+severity: MUST
+status: active
+domain: security
+priority: P0
+source:
+  - OWASP ASVS 5.0 V13
+applies_to:
+  - api
+success_criteria:
+  []
+requirement: >
+  Inbound webhooks MUST verify the provider signature against the raw body before any processing, MUST reject stale timestamps, and MUST be idempotent on the provider event id.
+validation:
+  automated: false
+  manual: true
+exceptions: none
+---
+
+# SEC-007 — Webhooks are verified and replay-protected
+
+**Requirement:** Inbound webhooks MUST verify the provider signature against the raw body before any processing, MUST reject stale timestamps, and MUST be idempotent on the provider event id.
+
+**Bad:** The handler trusts the payload and credits the account twice when the provider retries.
+
+**Good:** Signature verified on the raw body; event id stored; a repeat delivery is a no-op that returns 200.
+
+## Validation
+
+- Test: bad signature rejected
+- Test: duplicate delivery changes nothing
+- Test: stale timestamp rejected
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P0`
+- Exceptions: `none`
+
+## See also
+
+- [PAYMENTS.md](../../standard/engineering/payments/PAYMENTS.md)

package/rules/security/SEC-008.md

@@ -0,0 +1,39 @@
+---
+id: SEC-008
+title: Abuse surfaces are rate limited
+severity: MUST
+status: active
+domain: security
+priority: P1
+source:
+  - OWASP ASVS 5.0 V11
+applies_to:
+  - api
+success_criteria:
+  []
+requirement: >
+  Authentication, password reset, invitation, search, export and any expensive or enumerable endpoint MUST be rate limited per actor and per source, and MUST fail closed when the limiter is unavailable.
+validation:
+  automated: false
+  manual: true
+exceptions: documented-only
+---
+
+# SEC-008 — Abuse surfaces are rate limited
+
+**Requirement:** Authentication, password reset, invitation, search, export and any expensive or enumerable endpoint MUST be rate limited per actor and per source, and MUST fail closed when the limiter is unavailable.
+
+**Bad:** Unlimited login attempts, or a limiter that silently allows everything when its backend is down.
+
+**Good:** Per-account and per-IP limits with a clear 429, and a closed default when the limiter cannot answer.
+
+## Validation
+
+- Test: the limit triggers
+- Confirm behaviour when the limiter backend fails
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P1`
+- Exceptions: `documented-only`

package/rules/security/SEC-009.md

@@ -0,0 +1,40 @@
+---
+id: SEC-009
+title: Transport and browser security headers are set
+severity: MUST
+status: active
+domain: security
+priority: P1
+source:
+  - OWASP ASVS 5.0 V9
+applies_to:
+  - web
+  - api
+success_criteria:
+  []
+requirement: >
+  Production traffic MUST be TLS only, with HSTS, a content security policy, `X-Content-Type-Options`, a referrer policy, and cookies marked `Secure`, `HttpOnly` and `SameSite` as appropriate.
+validation:
+  automated: true
+  manual: true
+exceptions: documented-only
+---
+
+# SEC-009 — Transport and browser security headers are set
+
+**Requirement:** Production traffic MUST be TLS only, with HSTS, a content security policy, `X-Content-Type-Options`, a referrer policy, and cookies marked `Secure`, `HttpOnly` and `SameSite` as appropriate.
+
+**Bad:** A session cookie without `HttpOnly` on a site served over both HTTP and HTTPS.
+
+**Good:** HTTPS enforced with redirect and HSTS; CSP without `unsafe-inline`; cookies hardened.
+
+## Validation
+
+- Inspect response headers on a deployed environment
+- Check cookie flags
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P1`
+- Exceptions: `documented-only`

package/rules/security/SEC-010.md

@@ -0,0 +1,40 @@
+---
+id: SEC-010
+title: Least privilege for every credential and role
+severity: MUST
+status: active
+domain: security
+priority: P1
+source:
+  - OWASP ASVS 5.0 V1
+applies_to:
+  - service
+  - database
+  - devops
+success_criteria:
+  []
+requirement: >
+  Application credentials, CI tokens and cloud roles MUST hold the narrowest set of permissions the task needs, and MUST be scoped to the environment they serve.
+validation:
+  automated: false
+  manual: true
+exceptions: documented-only
+---
+
+# SEC-010 — Least privilege for every credential and role
+
+**Requirement:** Application credentials, CI tokens and cloud roles MUST hold the narrowest set of permissions the task needs, and MUST be scoped to the environment they serve.
+
+**Bad:** One database superuser shared by the app, the migration job and the analytics reader.
+
+**Good:** A migration role that can alter schema, an app role that cannot, a read-only analytics role.
+
+## Validation
+
+- Review the permission set of each credential the change touches
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P1`
+- Exceptions: `documented-only`