e821987d9a
Adds comprehensive protection against exposing internal implementation details in public-facing documentation. New Governance Rule (inst_084): - Quadrant: SYSTEM - Persistence: HIGH - Scope: Public documents (confidential:false) - Enforcement: Pre-commit hooks (mandatory) Implementation: 1. attack-surface-validator.util.js - Pattern detection for file paths, API endpoints, admin URLs, ports - Frontmatter parsing (respects confidential:true exemption) - Code block exemption (doesn't flag technical examples) - Intelligent line numbering for violation reporting 2. check-attack-surface.js - Pre-commit script that scans staged documents - User-friendly violation reporting with suggestions - Integration with git workflow 3. Pre-commit hook integration - Added as Check #3 in git hooks - Runs after prohibited terms, before test requirements - Blocks commits with attack surface exposures Detection Patterns: ✅ File paths: src/*, public/*, scripts/* ✅ API endpoints: /api/*, /admin/* ✅ File naming patterns: *.util.js, *.service.js ✅ Port numbers in prose ✅ Connection strings Exemptions: - Code blocks (```) - Inline code (`) - Confidential documents (confidential:true) - Internal technical documentation Security Rationale (Defense-in-Depth): - Prevents reconnaissance by obscuring architecture - Reduces attack surface by hiding implementation paths - Complements credential protection (inst_069/070) - Part of layered security strategy (inst_072) Testing: - Validated against test document with known exposures - 7 violations detected correctly - Code block exemption verified - All expected pattern types detected Example Violations Blocked: ❌ "Dashboard at /admin/audit-analytics.html" ✅ "Administrative Dashboard" ❌ "GET /api/admin/audit-logs endpoint" ✅ "Authenticated API for audit data" ❌ "In activity-classifier.util.js" ✅ "The activity classifier" This enforcement prevented the exact security issue discovered in governance-bi-tools.md which exposed admin paths and API endpoints. Also fixed prohibited terms checker to exempt instruction-history.json (which contains prohibited term DEFINITIONS, not violations). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
66 lines
2.4 KiB
JavaScript
Executable file
66 lines
2.4 KiB
JavaScript
Executable file
#!/usr/bin/env node
|
|
|
|
/**
|
|
* Add Attack Surface Exposure Prevention Rule (inst_084)
|
|
*/
|
|
|
|
const fs = require('fs');
|
|
const path = require('path');
|
|
|
|
const historyPath = path.join(__dirname, '../.claude/instruction-history.json');
|
|
const data = JSON.parse(fs.readFileSync(historyPath, 'utf8'));
|
|
|
|
const newInstruction = {
|
|
"id": "inst_084",
|
|
"text": "NEVER expose internal implementation details in public-facing documents (confidential:false). Block exact file paths, API endpoints, database schemas, port numbers, and internal URLs. Use generalized component names instead.",
|
|
"timestamp": new Date().toISOString(),
|
|
"quadrant": "SYSTEM",
|
|
"persistence": "HIGH",
|
|
"temporal_scope": "PERMANENT",
|
|
"verification_required": "MANDATORY",
|
|
"explicitness": 1.0,
|
|
"source": "security_requirement",
|
|
"session_id": "2025-10-27-attack-surface-prevention",
|
|
"parameters": {
|
|
"security_layer": "defense_in_depth",
|
|
"enforcement": "pre_commit_hook",
|
|
"scope": "public_documents"
|
|
},
|
|
"active": true,
|
|
"notes": "Prevents reconnaissance by obscuring internal architecture in public documentation. Part of defense-in-depth security strategy (inst_072).",
|
|
"examples": [
|
|
"❌ BAD: 'Dashboard at /admin/audit-analytics.html'",
|
|
"✅ GOOD: 'Administrative Dashboard'",
|
|
"❌ BAD: 'GET /api/admin/audit-logs endpoint'",
|
|
"✅ GOOD: 'Authenticated API for retrieving audit data'",
|
|
"❌ BAD: 'In activity-classifier.util.js'",
|
|
"✅ GOOD: 'The activity classifier'",
|
|
"❌ BAD: 'MongoDB on port 27017'",
|
|
"✅ GOOD: 'Database backend'"
|
|
],
|
|
"enforcement_patterns": [
|
|
"File paths: src/*, public/*, scripts/*",
|
|
"API endpoints: /api/*, /admin/*",
|
|
"File extensions in prose: .js, .html, .css",
|
|
"Port numbers in public docs",
|
|
"Internal URLs with specific paths"
|
|
],
|
|
"exemptions": [
|
|
"Code blocks in technical implementation guides marked confidential:true",
|
|
"Internal architectural documentation",
|
|
"Developer setup guides not published externally"
|
|
],
|
|
"related_rules": [
|
|
"inst_072"
|
|
]
|
|
};
|
|
|
|
data.instructions.push(newInstruction);
|
|
data.last_updated = new Date().toISOString();
|
|
|
|
fs.writeFileSync(historyPath, JSON.stringify(data, null, 2));
|
|
|
|
console.log('✅ Added inst_084: Attack Surface Exposure Prevention');
|
|
console.log(` Quadrant: ${newInstruction.quadrant}`);
|
|
console.log(` Persistence: ${newInstruction.persistence}`);
|
|
console.log(` Enforcement: Pre-commit hooks for public documents`);
|