|
1 | | -# rules |
2 | | -CodeGuard is an AI model-agnostic security framework and ruleset that embeds secure-by-default practices into AI coding workflows (generation and review). It ships core security rules, translators for popular coding agents, and validators to test rule compliance. |
| 1 | +# Project CodeGuard: Security Rules for AI Coding Agents |
| 2 | + |
| 3 | +[Project CodeGuard](https://project-codeguard.org) is an open-source, model-agnostic security framework that embeds secure-by-default practices into AI coding agent workflows. It provides comprehensive security rules that guide AI assistants to generate more secure code automatically. |
| 4 | + |
| 5 | +## Why Project CodeGuard? |
| 6 | + |
| 7 | +AI coding agents are transforming software engineering, but this speed can introduce security vulnerabilities. Is your AI coding agent implementation introducing security vulnerabilities? |
| 8 | + |
| 9 | +- ❌ Skipping input validation |
| 10 | +- ❌ Hardcoding secrets and credentials |
| 11 | +- ❌ Using weak cryptographic algorithms |
| 12 | +- ❌ Relying on unsafe functions |
| 13 | +- ❌ Missing authentication/authorization checks |
| 14 | +- ❌ Missing any other security best practice |
| 15 | + |
| 16 | +Project CodeGuard solves this by embedding security best practices directly into AI coding agent workflows. |
| 17 | + |
| 18 | +**During and After Code Generation.** |
| 19 | + |
| 20 | +These rules can be used for: |
| 21 | +- preventing vulnerabilities from being introduced during code generation |
| 22 | +- automated code review by AI agents |
| 23 | + |
| 24 | + |
| 25 | +## Security Coverage |
| 26 | + |
| 27 | +Our rules cover essential security domains: |
| 28 | + |
| 29 | +- **🔐 Cryptography**: Safe algorithms (including post-quantum cryptography), secure key management, certificate validation |
| 30 | +- **🛡️ Input Validation**: SQL injection prevention, XSS protection, command injection defense |
| 31 | +- **🔑 Authentication**: MFA best practices, OAuth/OIDC, secure session management |
| 32 | +- **⚡ Authorization**: RBAC/ABAC, access control, IDOR prevention |
| 33 | +- **📦 Supply Chain**: Dependency security, SBOM generation, vulnerability management |
| 34 | +- **☁️ Cloud Security**: IaC hardening, container security, Kubernetes best practices |
| 35 | +- **📱 Platform Security**: Mobile apps, web services, API security |
| 36 | +- **🔍 Data Protection**: Privacy, encryption at rest/transit, secure storage |
| 37 | + |
| 38 | +## Quick Start |
| 39 | + |
| 40 | +Get started in minutes: |
| 41 | + |
| 42 | +1. **Download the rules** from our [releases page](https://github.com/project-codeguard/rules/releases) |
| 43 | +2. **Copy to your project** - Place AI agent and IDE specific rules in your repository |
| 44 | +3. **Start coding** - AI assistants will automatically follow security best practices |
| 45 | + |
| 46 | +- Additional details in the [Get Started →](getting-started.md) |
| 47 | + |
| 48 | + |
| 49 | +## How It Works |
| 50 | + |
| 51 | +1. **Security rules** are written in a unified markdown format |
| 52 | +2. **Conversion tools** translate rules to IDE and AI agent formats |
| 53 | +3. **AI assistants** reference these rules when generating or reviewing code |
| 54 | +4. **Secure code** is produced automatically without developer intervention |
| 55 | + |
| 56 | +## Community |
| 57 | + |
| 58 | +- **📋 Issues**: [Report bugs or request features](https://github.com/project-codeguard/rules/issues) |
| 59 | +- **💬 Discussions**: [Join the conversation](https://github.com/project-codeguard/rules/discussions) |
| 60 | +- **🤝 Contributing**: [Learn how to contribute](https://github.com/project-codeguard/rules/blob/main/CONTRIBUTING.md) |
0 commit comments