codingwithagent 1.0.0 → 1.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (34) hide show
  1. package/CHANGELOG.md +28 -0
  2. package/LICENSE +21 -21
  3. package/README.md +131 -37
  4. package/bin/init.js +257 -257
  5. package/package.json +56 -56
  6. package/templates/accessibility/.cursorrules +342 -342
  7. package/templates/accessibility/README.md +47 -47
  8. package/templates/antigravity/accessibility/.agent/rules/accessibility.md +501 -501
  9. package/templates/antigravity/accessibility/.agent/rules/aria-patterns.md +568 -568
  10. package/templates/antigravity/accessibility/.agent/rules/wcag-standard.md +225 -225
  11. package/templates/antigravity/accessibility/README.md +42 -42
  12. package/templates/antigravity/minimal/.agent/rules/accessibility.md +53 -53
  13. package/templates/antigravity/minimal/.agent/rules/code-quality.md +86 -86
  14. package/templates/antigravity/minimal/.agent/rules/react-components.md +164 -164
  15. package/templates/antigravity/minimal/README.md +34 -34
  16. package/templates/antigravity/standard/.agent/rules/accessibility.md +98 -98
  17. package/templates/antigravity/standard/.agent/rules/code-quality.md +166 -166
  18. package/templates/antigravity/standard/.agent/rules/pull-request-review.md +192 -192
  19. package/templates/antigravity/standard/.agent/rules/react-components.md +204 -204
  20. package/templates/antigravity/standard/.agent/rules/testing.md +197 -197
  21. package/templates/antigravity/standard/README.md +39 -39
  22. package/templates/antigravity/strict/.agent/README.md +46 -46
  23. package/templates/antigravity/strict/.agent/rules/accessibility.md +199 -199
  24. package/templates/antigravity/strict/.agent/rules/code-quality.md +268 -268
  25. package/templates/antigravity/strict/.agent/rules/pull-request-review.md +114 -114
  26. package/templates/antigravity/strict/.agent/rules/react-components.md +423 -423
  27. package/templates/antigravity/strict/.agent/rules/security.md +483 -483
  28. package/templates/antigravity/strict/.agent/rules/testing.md +280 -280
  29. package/templates/minimal/.cursorrules +48 -48
  30. package/templates/minimal/README.md +40 -40
  31. package/templates/standard/.cursorrules +184 -184
  32. package/templates/standard/README.md +43 -43
  33. package/templates/strict/.cursorrules +227 -227
  34. package/templates/strict/README.md +47 -47
@@ -1,98 +1,98 @@
1
- ---
2
- trigger: always_on
3
- ---
4
-
5
- # Accessibility Standards (A11y)
6
-
7
- ## Compliance Requirements
8
-
9
- - Follow WCAG 2.1 Level AA standards (striving for 2.2)
10
- - All functionality must be keyboard accessible
11
- - Support screen readers (NVDA, JAWS, VoiceOver, TalkBack)
12
- - Comply with DOT regulations for airline digital accessibility
13
-
14
- ## POUR Principles
15
-
16
- - **Perceivable**: Everyone can "see" this (alt text, captions, sufficient contrast)
17
- - **Operable**: Everyone can operate this (keyboard navigation, no time limits)
18
- - **Understandable**: Everyone can understand this (readable text, predictable behavior)
19
- - **Robust**: All devices can use this (compatible with assistive technologies)
20
-
21
- ## Implementation Requirements
22
-
23
- ### Screen Reader Support
24
-
25
- - Use semantic HTML (header, nav, main, footer) for proper structure
26
- - All interactive elements must have accessible names
27
- - Use aria-label ONLY when text differs from visible content
28
- - Do NOT overuse role attributes, especially role="alert" (breaks semantic order)
29
- - Announce states properly: "selected", "expanded", "collapsed", "disabled"
30
-
31
- ### Semantic Order and Focus Management
32
-
33
- - Maintain logical reading order matching visual layout
34
- - Use proper heading hierarchy (h1 > h2 > h3, no skipping levels)
35
- - Group related sections with proper ARIA landmarks
36
- - Focus order must follow logical tab sequence
37
- - TabIndex must NEVER be > 0
38
-
39
- ### Form Accessibility
40
-
41
- - All form fields must have associated labels
42
- - Use validateOn: 'change' instead of 'blur' (better for autofill)
43
- - Provide clear error messages
44
- - Indicate required fields
45
- - Support keyboard navigation throughout forms
46
-
47
- ### Color and Contrast
48
-
49
- - Minimum contrast ratio: 4.5:1 for normal text, 3:1 for large text/icons
50
- - Never use color alone to convey information
51
- - Add additional visual indicators: shapes, icons, text, spacing
52
- - Use Color Contrast Analyzer (CCA) during design
53
-
54
- ### Images and Media
55
-
56
- - Provide meaningful alt text for all informative images
57
- - Use alt="" for decorative images
58
- - Avoid image-based text when possible
59
- - Provide captions and transcripts for video/audio
60
- - Never rely solely on visual cues
61
-
62
- ### Interactive Elements
63
-
64
- - Buttons minimum touch target: 24x24 CSS pixels
65
- - Links must have descriptive text (avoid "click here", "learn more")
66
- - External links should indicate new window with extDisclaimer
67
- - All custom actions must be accessible via screen readers
68
-
69
- ### Mobile Accessibility
70
-
71
- - iOS: Use UIAccessibilityCustomAction for custom gestures
72
- - iOS: Announce "double tap to select" for form field buttons
73
- - Android: Use contentDescription for ImageView, ImageButton, CheckBox
74
- - Android: Hint speech already announces custom actions (built-in)
75
- - Test with both VoiceOver (iOS) and TalkBack (Android)
76
-
77
- ## Testing Requirements
78
-
79
- - Perform desk checks with accessibility tools before PR
80
- - Test with keyboard navigation only (no mouse)
81
- - Test with screen readers (VoiceOver, NVDA, JAWS, TalkBack)
82
- - Use automated tools: Axe DevTools, Axe Basic, Lighthouse
83
- - Conduct manual testing with assistive technologies
84
- - Include accessibility acceptance criteria in all user stories
85
-
86
- ## Prohibited Practices
87
-
88
- - Do NOT use flashing/blinking content
89
- - Do NOT disable pinch-to-zoom
90
- - Do NOT use inaccessible PDFs without proper tagging
91
- - Do NOT create complex multi-column layouts
92
- - Do NOT use eslint-disable-line for a11y rules without approval
93
- - Do NOT mock screen reader implementations with aria-label
94
-
95
- ## Resources
96
-
97
- - W3C WCAG Guidelines: https://www.w3.org/WAI/standards-guidelines/wcag/
98
- - MagentaA11y Checklist: https://www.magentaa11y.com/web/
1
+ ---
2
+ trigger: always_on
3
+ ---
4
+
5
+ # Accessibility Standards (A11y)
6
+
7
+ ## Compliance Requirements
8
+
9
+ - Follow WCAG 2.1 Level AA standards (striving for 2.2)
10
+ - All functionality must be keyboard accessible
11
+ - Support screen readers (NVDA, JAWS, VoiceOver, TalkBack)
12
+ - Comply with DOT regulations for airline digital accessibility
13
+
14
+ ## POUR Principles
15
+
16
+ - **Perceivable**: Everyone can "see" this (alt text, captions, sufficient contrast)
17
+ - **Operable**: Everyone can operate this (keyboard navigation, no time limits)
18
+ - **Understandable**: Everyone can understand this (readable text, predictable behavior)
19
+ - **Robust**: All devices can use this (compatible with assistive technologies)
20
+
21
+ ## Implementation Requirements
22
+
23
+ ### Screen Reader Support
24
+
25
+ - Use semantic HTML (header, nav, main, footer) for proper structure
26
+ - All interactive elements must have accessible names
27
+ - Use aria-label ONLY when text differs from visible content
28
+ - Do NOT overuse role attributes, especially role="alert" (breaks semantic order)
29
+ - Announce states properly: "selected", "expanded", "collapsed", "disabled"
30
+
31
+ ### Semantic Order and Focus Management
32
+
33
+ - Maintain logical reading order matching visual layout
34
+ - Use proper heading hierarchy (h1 > h2 > h3, no skipping levels)
35
+ - Group related sections with proper ARIA landmarks
36
+ - Focus order must follow logical tab sequence
37
+ - TabIndex must NEVER be > 0
38
+
39
+ ### Form Accessibility
40
+
41
+ - All form fields must have associated labels
42
+ - Use validateOn: 'change' instead of 'blur' (better for autofill)
43
+ - Provide clear error messages
44
+ - Indicate required fields
45
+ - Support keyboard navigation throughout forms
46
+
47
+ ### Color and Contrast
48
+
49
+ - Minimum contrast ratio: 4.5:1 for normal text, 3:1 for large text/icons
50
+ - Never use color alone to convey information
51
+ - Add additional visual indicators: shapes, icons, text, spacing
52
+ - Use Color Contrast Analyzer (CCA) during design
53
+
54
+ ### Images and Media
55
+
56
+ - Provide meaningful alt text for all informative images
57
+ - Use alt="" for decorative images
58
+ - Avoid image-based text when possible
59
+ - Provide captions and transcripts for video/audio
60
+ - Never rely solely on visual cues
61
+
62
+ ### Interactive Elements
63
+
64
+ - Buttons minimum touch target: 24x24 CSS pixels
65
+ - Links must have descriptive text (avoid "click here", "learn more")
66
+ - External links should indicate new window with extDisclaimer
67
+ - All custom actions must be accessible via screen readers
68
+
69
+ ### Mobile Accessibility
70
+
71
+ - iOS: Use UIAccessibilityCustomAction for custom gestures
72
+ - iOS: Announce "double tap to select" for form field buttons
73
+ - Android: Use contentDescription for ImageView, ImageButton, CheckBox
74
+ - Android: Hint speech already announces custom actions (built-in)
75
+ - Test with both VoiceOver (iOS) and TalkBack (Android)
76
+
77
+ ## Testing Requirements
78
+
79
+ - Perform desk checks with accessibility tools before PR
80
+ - Test with keyboard navigation only (no mouse)
81
+ - Test with screen readers (VoiceOver, NVDA, JAWS, TalkBack)
82
+ - Use automated tools: Axe DevTools, Axe Basic, Lighthouse
83
+ - Conduct manual testing with assistive technologies
84
+ - Include accessibility acceptance criteria in all user stories
85
+
86
+ ## Prohibited Practices
87
+
88
+ - Do NOT use flashing/blinking content
89
+ - Do NOT disable pinch-to-zoom
90
+ - Do NOT use inaccessible PDFs without proper tagging
91
+ - Do NOT create complex multi-column layouts
92
+ - Do NOT use eslint-disable-line for a11y rules without approval
93
+ - Do NOT mock screen reader implementations with aria-label
94
+
95
+ ## Resources
96
+
97
+ - W3C WCAG Guidelines: https://www.w3.org/WAI/standards-guidelines/wcag/
98
+ - MagentaA11y Checklist: https://www.magentaa11y.com/web/
@@ -1,166 +1,166 @@
1
- ---
2
- trigger: always_on
3
- ---
4
-
5
- # Code Quality and Standards
6
-
7
- ## Why Code Quality Matters
8
-
9
- - Prevents production defects and reduces technical debt
10
- - Ensures maintainable and debuggable code
11
- - Enables predictable enhancements without side effects
12
- - Reduces legal, security, and brand risks
13
- - Improves developer experience and team efficiency
14
-
15
- ## Folder Structure and Architecture
16
-
17
- - Follow strict pod-based architecture
18
- - Structure: `<podName>/<flowName>/container/<containerName>`
19
- - Structure: `<podName>/<flowName>/component/<componentName>`
20
- - Structure: `<podName>/<flowName>/feature/<featureName>`
21
- - Structure: `<podName>/common/utils|constants|feature`
22
- - Structure: `/common/<domainName>/utils|constants|feature`
23
- - Do NOT breach pod boundaries without architecture approval
24
-
25
- ## Naming Conventions
26
-
27
- - **Variables**: camelCase (thisIsAVariable)
28
- - **Functions**: camelCase (thisIsAFunction)
29
- - **Constants**: UPPER_SNAKE_CASE (THIS_IS_A_CONSTANT)
30
- - **Acronyms**: UPPER_CASE (TIA = "This Is an Acronym")
31
- - **Components**: PascalCase (ThisIsAComponent)
32
- - **Object Props**: camelCase ({amount: 1, currency: 'USD'})
33
- - **URLs**: lowercase with "-" or "/" separators
34
- - Use descriptive names, avoid abbreviations (shouldDisplayTravelWaiverMessage NOT shouldDsplyTrvlWavrMsg)
35
-
36
- ## JavaScript Best Practices
37
-
38
- ### General Rules
39
-
40
- - Use ES6+ syntax (arrow functions, destructuring, template literals)
41
- - Prefer `const` over `let`, avoid `var` completely
42
- - Avoid `let` whenever possible - seek immutability
43
- - No anonymous functions as event handlers - declare named functions
44
- - Remove all console.log and debugger statements before PR
45
- - No eslint-disable-line without architecture team approval
46
-
47
- ### Prohibited or Restricted Patterns
48
-
49
- - Do NOT use `window` object (except with arch team clearance)
50
- - Do NOT import entire lodash library: `import get from 'lodash/get'` (allowed but discouraged)
51
- - Do NOT use `Date()` - use moment instead
52
- - Do NOT use `forEach` - use map, filter, reduce, or for...of
53
- - Do NOT use "will" lifecycle methods except componentWillUnmount
54
- - Do NOT trust BFF responses - always validate and set defaults
55
- - Do NOT use `tabIndex > 0`
56
-
57
- ### Props and State Management
58
-
59
- - Destructure props at function signature level
60
- - Avoid prop drilling beyond 3 levels - use intermediate containers
61
- - Use Redux for global state, local state only for UI-specific concerns
62
- - Required props: Mark functions and data needed for functionality as required
63
- - PropTypes: Define in external file at wrapper level for reusability
64
- - Use null chain operator for service responses with mapper layer
65
-
66
- ### Pure Functions and Complexity
67
-
68
- - Write pure functions whenever possible (no side effects)
69
- - Functions should do one thing well
70
- - Maximum function length: 50 lines
71
- - Remove dormant (dead) code immediately
72
- - Refactor when components exceed 200 lines
73
- - Extract complex logic to utility functions or selectors
74
-
75
- ### Data Handling
76
-
77
- - Always validate service responses with null checks
78
- - Create mappers between services and store
79
- - Use selectors for all data transformations
80
- - Move data processing from render to selectors
81
- - Use constants file for string values and configuration
82
-
83
- ## Component Standards
84
-
85
- ### Component Types
86
-
87
- - Prefer functional components with hooks over class components
88
- - Use PureComponent ONLY if props are immutable (primitives or ImmutableJS)
89
- - Stateless pure presentational components preferred
90
- - Return `false` instead of `null` to keep children linked to tree
91
-
92
- ### React Hooks
93
-
94
- - **useEffect**: Stay reactive, be mindful of dependencies array
95
- - **useMemo**: Use for expensive calculations only
96
- - **useCallback**: Use to prevent unnecessary re-renders
97
- - **useRef**: Bridge between JS DOM and React context
98
- - Custom hooks: Declare at component level or in hooks directory
99
-
100
- ### Component Requirements
101
-
102
- - All components must have PropTypes defined
103
- - Provide defaultProps for optional props
104
- - Use fragments `<></>` instead of empty divs
105
- - Keys must come from data props, NOT array index or random IDs
106
- - Conditional rendering: All conditionals must be boolean (non-boolean values render)
107
- - Avoid prop drilling: Use intermediate containers beyond 3 levels
108
-
109
- ### JSX Best Practices
110
-
111
- - Presentational components should receive data via props only
112
- - No business logic in JSX components - use selectors
113
- - Extract methods returning JSX as separate components
114
- - Use memoization for expensive rendering logic
115
- - Keep components small and reusable (<200 lines)
116
- - One responsibility per component
117
-
118
- ## Styling
119
-
120
- ### CSS/SCSS Standards
121
-
122
- - Use mobile-first approach (avoid max-width)
123
- - Do NOT use `:global` without architecture approval
124
- - Use `atm-u` utility classes, NOT `atm-c` component classes
125
- - All CSS must have parent class selector (no global impact)
126
- - Use Atmos components and design system
127
- - Maintain 4.5:1 contrast ratio for text, 3:1 for UI elements
128
-
129
- ### Emotion/CSS-in-JS
130
-
131
- - Follow Atmos styling patterns
132
- - Use JSON theme values when available
133
- - Avoid inline styles unless absolutely necessary
134
-
135
- ## Redux and State Management
136
-
137
- ### Redux Patterns
138
-
139
- - Use Redux Toolkit for all new state management
140
- - Local state for UI-only concerns (modals, tooltips)
141
- - Global state for shared data and server responses
142
- - Do NOT use react-redux-form state - use model instead
143
- - Define actions and reducers in feature folders
144
-
145
- ### Sagas
146
-
147
- - Follow saga implementation patterns
148
- - Handle async operations in sagas, not components
149
- - Use try-catch for error handling
150
- - Implement request/response cycle properly
151
- - Maintain immutability with "Current" record pattern
152
-
153
- ## Internationalization (i18n)
154
-
155
- - Use `<FormattedMessage>` instead of `intl.formatMessage` in JSX
156
- - Extract messages after every change (provide screenshot for context)
157
- - Verify scope and ID match file location
158
- - Do NOT send variable messages to intl - validate existence with defaults
159
- - Inject intl at container level only once
160
-
161
- ## Security and PII
162
-
163
- - Mask credit cards: First 12 digits as asterisks/bullets, last 4 visible
164
- - Follow PII masking guidelines for all personal data
165
- - No PCI/PII data in logs or monitoring
166
- - Validate and sanitize all user inputs
1
+ ---
2
+ trigger: always_on
3
+ ---
4
+
5
+ # Code Quality and Standards
6
+
7
+ ## Why Code Quality Matters
8
+
9
+ - Prevents production defects and reduces technical debt
10
+ - Ensures maintainable and debuggable code
11
+ - Enables predictable enhancements without side effects
12
+ - Reduces legal, security, and brand risks
13
+ - Improves developer experience and team efficiency
14
+
15
+ ## Folder Structure and Architecture
16
+
17
+ - Follow strict pod-based architecture
18
+ - Structure: `<podName>/<flowName>/container/<containerName>`
19
+ - Structure: `<podName>/<flowName>/component/<componentName>`
20
+ - Structure: `<podName>/<flowName>/feature/<featureName>`
21
+ - Structure: `<podName>/common/utils|constants|feature`
22
+ - Structure: `/common/<domainName>/utils|constants|feature`
23
+ - Do NOT breach pod boundaries without architecture approval
24
+
25
+ ## Naming Conventions
26
+
27
+ - **Variables**: camelCase (thisIsAVariable)
28
+ - **Functions**: camelCase (thisIsAFunction)
29
+ - **Constants**: UPPER_SNAKE_CASE (THIS_IS_A_CONSTANT)
30
+ - **Acronyms**: UPPER_CASE (TIA = "This Is an Acronym")
31
+ - **Components**: PascalCase (ThisIsAComponent)
32
+ - **Object Props**: camelCase ({amount: 1, currency: 'USD'})
33
+ - **URLs**: lowercase with "-" or "/" separators
34
+ - Use descriptive names, avoid abbreviations (shouldDisplayTravelWaiverMessage NOT shouldDsplyTrvlWavrMsg)
35
+
36
+ ## JavaScript Best Practices
37
+
38
+ ### General Rules
39
+
40
+ - Use ES6+ syntax (arrow functions, destructuring, template literals)
41
+ - Prefer `const` over `let`, avoid `var` completely
42
+ - Avoid `let` whenever possible - seek immutability
43
+ - No anonymous functions as event handlers - declare named functions
44
+ - Remove all console.log and debugger statements before PR
45
+ - No eslint-disable-line without architecture team approval
46
+
47
+ ### Prohibited or Restricted Patterns
48
+
49
+ - Do NOT use `window` object (except with arch team clearance)
50
+ - Do NOT import entire lodash library: `import get from 'lodash/get'` (allowed but discouraged)
51
+ - Do NOT use `Date()` - use moment instead
52
+ - Do NOT use `forEach` - use map, filter, reduce, or for...of
53
+ - Do NOT use "will" lifecycle methods except componentWillUnmount
54
+ - Do NOT trust BFF responses - always validate and set defaults
55
+ - Do NOT use `tabIndex > 0`
56
+
57
+ ### Props and State Management
58
+
59
+ - Destructure props at function signature level
60
+ - Avoid prop drilling beyond 3 levels - use intermediate containers
61
+ - Use Redux for global state, local state only for UI-specific concerns
62
+ - Required props: Mark functions and data needed for functionality as required
63
+ - PropTypes: Define in external file at wrapper level for reusability
64
+ - Use null chain operator for service responses with mapper layer
65
+
66
+ ### Pure Functions and Complexity
67
+
68
+ - Write pure functions whenever possible (no side effects)
69
+ - Functions should do one thing well
70
+ - Maximum function length: 50 lines
71
+ - Remove dormant (dead) code immediately
72
+ - Refactor when components exceed 200 lines
73
+ - Extract complex logic to utility functions or selectors
74
+
75
+ ### Data Handling
76
+
77
+ - Always validate service responses with null checks
78
+ - Create mappers between services and store
79
+ - Use selectors for all data transformations
80
+ - Move data processing from render to selectors
81
+ - Use constants file for string values and configuration
82
+
83
+ ## Component Standards
84
+
85
+ ### Component Types
86
+
87
+ - Prefer functional components with hooks over class components
88
+ - Use PureComponent ONLY if props are immutable (primitives or ImmutableJS)
89
+ - Stateless pure presentational components preferred
90
+ - Return `false` instead of `null` to keep children linked to tree
91
+
92
+ ### React Hooks
93
+
94
+ - **useEffect**: Stay reactive, be mindful of dependencies array
95
+ - **useMemo**: Use for expensive calculations only
96
+ - **useCallback**: Use to prevent unnecessary re-renders
97
+ - **useRef**: Bridge between JS DOM and React context
98
+ - Custom hooks: Declare at component level or in hooks directory
99
+
100
+ ### Component Requirements
101
+
102
+ - All components must have PropTypes defined
103
+ - Provide defaultProps for optional props
104
+ - Use fragments `<></>` instead of empty divs
105
+ - Keys must come from data props, NOT array index or random IDs
106
+ - Conditional rendering: All conditionals must be boolean (non-boolean values render)
107
+ - Avoid prop drilling: Use intermediate containers beyond 3 levels
108
+
109
+ ### JSX Best Practices
110
+
111
+ - Presentational components should receive data via props only
112
+ - No business logic in JSX components - use selectors
113
+ - Extract methods returning JSX as separate components
114
+ - Use memoization for expensive rendering logic
115
+ - Keep components small and reusable (<200 lines)
116
+ - One responsibility per component
117
+
118
+ ## Styling
119
+
120
+ ### CSS/SCSS Standards
121
+
122
+ - Use mobile-first approach (avoid max-width)
123
+ - Do NOT use `:global` without architecture approval
124
+ - Use `atm-u` utility classes, NOT `atm-c` component classes
125
+ - All CSS must have parent class selector (no global impact)
126
+ - Use Atmos components and design system
127
+ - Maintain 4.5:1 contrast ratio for text, 3:1 for UI elements
128
+
129
+ ### Emotion/CSS-in-JS
130
+
131
+ - Follow Atmos styling patterns
132
+ - Use JSON theme values when available
133
+ - Avoid inline styles unless absolutely necessary
134
+
135
+ ## Redux and State Management
136
+
137
+ ### Redux Patterns
138
+
139
+ - Use Redux Toolkit for all new state management
140
+ - Local state for UI-only concerns (modals, tooltips)
141
+ - Global state for shared data and server responses
142
+ - Do NOT use react-redux-form state - use model instead
143
+ - Define actions and reducers in feature folders
144
+
145
+ ### Sagas
146
+
147
+ - Follow saga implementation patterns
148
+ - Handle async operations in sagas, not components
149
+ - Use try-catch for error handling
150
+ - Implement request/response cycle properly
151
+ - Maintain immutability with "Current" record pattern
152
+
153
+ ## Internationalization (i18n)
154
+
155
+ - Use `<FormattedMessage>` instead of `intl.formatMessage` in JSX
156
+ - Extract messages after every change (provide screenshot for context)
157
+ - Verify scope and ID match file location
158
+ - Do NOT send variable messages to intl - validate existence with defaults
159
+ - Inject intl at container level only once
160
+
161
+ ## Security and PII
162
+
163
+ - Mask credit cards: First 12 digits as asterisks/bullets, last 4 visible
164
+ - Follow PII masking guidelines for all personal data
165
+ - No PCI/PII data in logs or monitoring
166
+ - Validate and sanitize all user inputs