praxis-sec 1.0.0

package/configs/gitignore-template

@@ -0,0 +1,258 @@
+# =============================================================================
+# PRAXIS .GITIGNORE
+# =============================================================================
+# This file prevents you from accidentally committing sensitive data.
+# Copy this to your project root. Customize as needed.
+# =============================================================================
+
+# -----------------------------------------------------------------------------
+# ENVIRONMENT FILES - THE #1 SOURCE OF LEAKED SECRETS
+# -----------------------------------------------------------------------------
+# These files often contain API keys, database URLs, and passwords.
+# NEVER commit these. Use .env.example with placeholder values instead.
+
+.env
+.env.local
+.env.development
+.env.development.local
+.env.test
+.env.test.local
+.env.production
+.env.production.local
+.env.staging
+.env*.local
+
+# Some frameworks use different names
+.envrc
+.env.backup
+.env.bak
+*.env
+
+# -----------------------------------------------------------------------------
+# PRIVATE KEYS & CERTIFICATES
+# -----------------------------------------------------------------------------
+# These are cryptographic secrets. If leaked, attackers can impersonate you.
+
+*.pem
+*.key
+*.p12
+*.pfx
+*.crt
+*.cer
+*.der
+*.csr
+
+# SSH keys - NEVER commit these
+id_rsa
+id_rsa.pub
+id_ed25519
+id_ed25519.pub
+id_dsa
+id_dsa.pub
+*.ppk
+
+# GPG keys
+*.gpg
+*.asc
+secring.*
+
+# -----------------------------------------------------------------------------
+# API KEYS & CREDENTIALS FILES
+# -----------------------------------------------------------------------------
+# Various tools store credentials in these files
+
+# Google Cloud / Firebase
+**/service-account*.json
+*-firebase-adminsdk-*.json
+credentials.json
+client_secret*.json
+
+# AWS
+.aws/credentials
+aws-credentials.json
+*.aws
+
+# Stripe
+stripe-cli-config.toml
+
+# Generic credential files
+*credentials*
+*secrets*
+*.secrets.json
+config/secrets.yml
+secrets.yml
+secrets.yaml
+
+# Exception: Allow our security scanning scripts
+!scripts/
+!scripts/*
+
+# -----------------------------------------------------------------------------
+# DATABASE FILES
+# -----------------------------------------------------------------------------
+# Local databases may contain user data or test credentials
+
+*.sqlite
+*.sqlite3
+*.db
+*.sql
+dump.rdb
+
+# -----------------------------------------------------------------------------
+# LOGS - MAY CONTAIN SENSITIVE DATA
+# -----------------------------------------------------------------------------
+# Logs can accidentally contain API responses, user data, or errors with secrets
+
+*.log
+logs/
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+# -----------------------------------------------------------------------------
+# OS FILES - NOT SENSITIVE BUT ANNOYING
+# -----------------------------------------------------------------------------
+
+# macOS
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+.AppleDouble
+.LSOverride
+
+# Windows
+Thumbs.db
+Thumbs.db:encryptable
+ehthumbs.db
+ehthumbs_vista.db
+*.stackdump
+[Dd]esktop.ini
+$RECYCLE.BIN/
+*.cab
+*.msi
+*.msix
+*.msm
+*.msp
+*.lnk
+
+# Linux
+*~
+.fuse_hidden*
+.directory
+.Trash-*
+.nfs*
+
+# -----------------------------------------------------------------------------
+# IDE & EDITOR FILES
+# -----------------------------------------------------------------------------
+# May contain local paths or workspace settings with secrets
+
+.idea/
+.vscode/
+*.swp
+*.swo
+*.swn
+*.sublime-workspace
+*.sublime-project
+.project
+.classpath
+.settings/
+*.code-workspace
+
+# -----------------------------------------------------------------------------
+# DEPENDENCY DIRECTORIES
+# -----------------------------------------------------------------------------
+# These are large and should be installed fresh via package manager
+
+node_modules/
+vendor/
+.bundle/
+bower_components/
+jspm_packages/
+
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+.Python
+venv/
+env/
+ENV/
+.venv/
+pip-log.txt
+pip-delete-this-directory.txt
+
+# -----------------------------------------------------------------------------
+# BUILD OUTPUT - MAY CONTAIN INLINED SECRETS
+# -----------------------------------------------------------------------------
+# Build processes sometimes inline environment variables
+
+.next/
+.nuxt/
+dist/
+build/
+out/
+.output/
+.cache/
+.parcel-cache/
+.turbo/
+
+# -----------------------------------------------------------------------------
+# TEST & COVERAGE - MAY CONTAIN SNAPSHOTS OF SENSITIVE DATA
+# -----------------------------------------------------------------------------
+
+coverage/
+.nyc_output/
+*.lcov
+
+# -----------------------------------------------------------------------------
+# VERCEL & DEPLOYMENT
+# -----------------------------------------------------------------------------
+# Vercel CLI may cache tokens
+
+.vercel/
+
+# -----------------------------------------------------------------------------
+# MISC SECURITY-SENSITIVE PATTERNS
+# -----------------------------------------------------------------------------
+
+# Backup files might contain old secrets
+*.bak
+*.backup
+*.old
+*.orig
+*.temp
+*.tmp
+
+# Archives that might contain sensitive exports
+*.zip
+*.tar
+*.tar.gz
+*.tgz
+*.rar
+
+# Docker secrets
+docker-compose.override.yml
+.docker/
+
+# Terraform state (contains infrastructure secrets)
+*.tfstate
+*.tfstate.*
+.terraform/
+*.tfvars
+
+# Ansible vault
+*.vault
+
+# Kubernetes secrets
+*kubeconfig*
+
+# -----------------------------------------------------------------------------
+# ADD YOUR PROJECT-SPECIFIC IGNORES BELOW
+# -----------------------------------------------------------------------------
+
+.claude/

package/configs/nextjs-security-headers.js

@@ -0,0 +1,220 @@
+/**
+ * Praxis - Next.js Security Headers Configuration
+ * ===================================================
+ *
+ * Drop this into your next.config.js to add essential security headers.
+ *
+ * WHY THESE HEADERS MATTER:
+ * Without security headers, your app is vulnerable to:
+ * - Clickjacking (your site loaded in malicious iframes)
+ * - XSS attacks (malicious scripts injected into your pages)
+ * - MIME sniffing (browsers misinterpreting file types)
+ * - Protocol downgrade attacks (HTTPS -> HTTP)
+ *
+ * HOW TO USE:
+ * 1. Copy this file to your Next.js project root
+ * 2. Import and spread into your next.config.js (see example at bottom)
+ *
+ * TEST YOUR HEADERS:
+ * After deploying, check your score at: https://securityheaders.com
+ */
+
+const securityHeaders = [
+  // ==========================================================================
+  // CLICKJACKING PROTECTION
+  // ==========================================================================
+  {
+    key: 'X-Frame-Options',
+    value: 'DENY'
+    // WHAT: Prevents your site from being embedded in iframes
+    // WHY: Attackers could overlay invisible buttons on your site (clickjacking)
+    // OPTIONS:
+    //   'DENY' - Never allow framing (most secure)
+    //   'SAMEORIGIN' - Only allow framing by your own site
+    // NOTE: Use 'SAMEORIGIN' if you need iframes for your own features
+  },
+
+  // ==========================================================================
+  // XSS PROTECTION
+  // ==========================================================================
+  {
+    key: 'X-XSS-Protection',
+    value: '1; mode=block'
+    // WHAT: Enables browser's built-in XSS filter
+    // WHY: Adds a layer of defense against reflected XSS attacks
+    // NOTE: Modern browsers use CSP instead, but this helps older browsers
+  },
+  {
+    key: 'X-Content-Type-Options',
+    value: 'nosniff'
+    // WHAT: Prevents browsers from MIME-sniffing (guessing file types)
+    // WHY: Attackers could trick browsers into executing malicious content
+    //      by serving scripts with incorrect MIME types
+  },
+
+  // ==========================================================================
+  // HTTPS ENFORCEMENT
+  // ==========================================================================
+  {
+    key: 'Strict-Transport-Security',
+    value: 'max-age=31536000; includeSubDomains; preload'
+    // WHAT: Forces browsers to always use HTTPS for your site
+    // WHY: Prevents protocol downgrade attacks and cookie hijacking
+    // BREAKDOWN:
+    //   max-age=31536000 - Remember for 1 year (in seconds)
+    //   includeSubDomains - Apply to all subdomains too
+    //   preload - Allow inclusion in browser's HSTS preload list
+    // WARNING: Only enable 'preload' if you're CERTAIN all subdomains support HTTPS
+  },
+
+  // ==========================================================================
+  // REFERRER POLICY
+  // ==========================================================================
+  {
+    key: 'Referrer-Policy',
+    value: 'strict-origin-when-cross-origin'
+    // WHAT: Controls how much referrer info is sent to other sites
+    // WHY: Prevents leaking sensitive URLs (with tokens, user IDs, etc.)
+    // THIS SETTING: Send origin only (not full URL) for cross-origin requests
+    // OPTIONS:
+    //   'no-referrer' - Never send referrer (most private, may break analytics)
+    //   'strict-origin' - Only send origin, never on HTTP downgrade
+    //   'strict-origin-when-cross-origin' - Full URL same-site, origin cross-site
+  },
+
+  // ==========================================================================
+  // PERMISSIONS POLICY (formerly Feature-Policy)
+  // ==========================================================================
+  {
+    key: 'Permissions-Policy',
+    value: 'camera=(), microphone=(), geolocation=(), interest-cohort=()'
+    // WHAT: Disables browser features you don't need
+    // WHY: Reduces attack surface; malicious scripts can't access these APIs
+    // THIS SETTING: Disables camera, mic, location, and FLoC tracking
+    // CUSTOMIZE: If you need camera/mic (e.g., for video chat), update this:
+    //   camera=(self) - Allow camera only from your own origin
+    //   microphone=(self "https://trusted-site.com") - Allow from specific origins
+  },
+
+  // ==========================================================================
+  // CONTENT SECURITY POLICY (CSP)
+  // ==========================================================================
+  // CSP is your most powerful defense against XSS attacks.
+  // It tells the browser exactly which resources are allowed to load.
+  //
+  // WARNING: CSP can break your site if misconfigured!
+  // Start with 'Content-Security-Policy-Report-Only' to test without blocking.
+  {
+    key: 'Content-Security-Policy',
+    value: [
+      // DEFAULT: Block everything not explicitly allowed
+      "default-src 'self'",
+
+      // SCRIPTS: Only from your domain + inline scripts (needed for Next.js)
+      // NOTE: 'unsafe-inline' is needed for Next.js. For maximum security,
+      // use nonces instead (requires custom server setup)
+      "script-src 'self' 'unsafe-inline' 'unsafe-eval'",
+
+      // STYLES: Your domain + inline styles (needed for most CSS-in-JS)
+      "style-src 'self' 'unsafe-inline'",
+
+      // IMAGES: Your domain + data URIs + common CDNs
+      // ADD your image CDN here if needed (e.g., images.unsplash.com)
+      "img-src 'self' data: blob: https:",
+
+      // FONTS: Your domain + Google Fonts
+      "font-src 'self' https://fonts.gstatic.com",
+
+      // CONNECTIONS (fetch, WebSocket, etc.): Your domain + your API
+      // ADD your API domains here
+      "connect-src 'self' https://api.openai.com https://api.anthropic.com",
+
+      // FRAMES: Block all iframes by default
+      // Change to 'self' if you need iframes from your own domain
+      "frame-src 'none'",
+
+      // PREVENT your site from being framed
+      "frame-ancestors 'none'",
+
+      // FORMS: Only submit to your own domain
+      "form-action 'self'",
+
+      // BASE URI: Prevent base tag injection
+      "base-uri 'self'",
+
+      // UPGRADE insecure requests to HTTPS
+      "upgrade-insecure-requests",
+    ].join('; ')
+    //
+    // DEBUGGING CSP:
+    // 1. Open browser DevTools > Console
+    // 2. Look for "Refused to load..." errors
+    // 3. Add the blocked domain to the appropriate directive
+    //
+    // COMMON ADDITIONS:
+    // - Google Analytics: Add to script-src and connect-src
+    //   script-src: https://www.googletagmanager.com
+    //   connect-src: https://www.google-analytics.com
+    // - Stripe:
+    //   script-src: https://js.stripe.com
+    //   frame-src: https://js.stripe.com
+  },
+];
+
+/**
+ * Export the headers configuration for next.config.js
+ *
+ * USAGE IN next.config.js:
+ *
+ * const { securityHeadersConfig } = require('./nextjs-security-headers');
+ *
+ * module.exports = {
+ *   ...securityHeadersConfig,
+ *   // your other config options...
+ * };
+ *
+ * OR for ES modules (next.config.mjs):
+ *
+ * import { securityHeadersConfig } from './nextjs-security-headers.js';
+ *
+ * export default {
+ *   ...securityHeadersConfig,
+ *   // your other config options...
+ * };
+ */
+const securityHeadersConfig = {
+  async headers() {
+    return [
+      {
+        // Apply to all routes
+        source: '/:path*',
+        headers: securityHeaders,
+      },
+    ];
+  },
+};
+
+// =============================================================================
+// COMPLETE EXAMPLE: next.config.js
+// =============================================================================
+/*
+// next.config.js (CommonJS)
+const { securityHeadersConfig } = require('./nextjs-security-headers');
+
+module.exports = {
+  ...securityHeadersConfig,
+  reactStrictMode: true,
+  // ... your other config
+};
+
+// OR next.config.mjs (ES Modules)
+import { securityHeadersConfig } from './nextjs-security-headers.js';
+
+export default {
+  ...securityHeadersConfig,
+  reactStrictMode: true,
+  // ... your other config
+};
+*/
+
+module.exports = { securityHeaders, securityHeadersConfig };

package/configs/praxisignore-template

@@ -0,0 +1,50 @@
+# .praxisignore
+# =================
+# Exclude paths from praxis secret scanning.
+# Same syntax as .gitignore — one pattern per line, # for comments.
+#
+# Praxis already skips test files by default.
+# Use this file to exclude additional paths that generate false positives.
+#
+# USAGE:
+#   Copy this file to your project root as .praxisignore
+#   Then run: npx praxis scan .
+
+# ── Examples ──────────────────────────────────────────────────────────────────
+
+# Exclude a specific file
+# config/seed-data.js
+
+# Exclude a directory
+# scripts/fixtures/
+
+# Exclude all files matching a pattern
+# **/*.example.js
+# **/*.sample.*
+
+# Exclude documentation that contains example credentials
+# docs/
+# *.md
+
+# Exclude generated files
+# generated/
+# prisma/migrations/
+
+# Exclude vendor/third-party code not in node_modules
+# vendor/
+# third-party/
+
+# ── Common false positive sources ─────────────────────────────────────────────
+
+# E2E test fixtures (praxis skips unit tests but not e2e by default)
+# e2e/
+# cypress/fixtures/
+# playwright/
+
+# Seed data with example values
+# prisma/seed.ts
+# database/seeds/
+
+# Infrastructure-as-code with example configs
+# terraform/examples/
+# .terraform/