Skip to content

Security - Edition v1

Edition metadata

Targets: browser apps · APIs · Cloudflare Workers/Pages Functions · MCP · CLIs · SDKs · GitHub Actions Reviewed: 2026-07 · Next review due: 2027-07 Status: latest · Pin as: security@v1 Canonical URL: https://vibecodeqa.online/standards/security/v1/

This edition captures the cross-cutting security baseline VibeCode QA applies across repo slices. It focuses on checkable code and deployment signals, then defers broad security taxonomy to upstream authorities.

Rule shape

Each rule has a stable ID (R-<AREA>-<n>), one checkable statement, the reason it exists, a vcqa signal, and primary references.

The rubric

# Area Code What it governs
1 Authorization boundaries AUTHZ / SESSION protected read/write boundary, tenant and role checks, cookie/session controls
2 Secrets and environment exposure SECRET / ENV secret storage, client env leakage, preview/prod separation
3 Input, query, and command safety INPUT / SQL / CMD / FETCH untrusted input validation, parameterized queries, command and URL safety
4 Output, browser, and tool safety OUT / XSS / TOOL encoded output, dangerous HTML, untrusted MCP/tool content
5 Tenant and environment isolation TENANT / BOUNDARY tenant scoping, preview/staging/prod isolation, shared-resource evidence
6 CI and deployment security CI / DEPLOY / TOKEN workflow permissions, protected production mutation, deploy credential scope
7 Logging and incident evidence LOG / AUDIT / INCIDENT security events, safe logging, traceable mutating operations

Non-negotiables

  • R-AUTHZ-1 - protected reads and writes enforce authorization at the server, Function, Worker, MCP tool, CLI, or command boundary that performs the action.
  • R-AUTHZ-2 - tenant identity, role, and resource ownership are derived server-side or from trusted claims, never only from client route state or request body convention.
  • R-SECRET-1 - secrets are not committed, bundled into browser code, exposed through public env names, or reused across preview/staging/production without an exception.
  • R-SQL-1 - untrusted values enter database queries through parameter binding or an equivalent safe query API.
  • R-XSS-1 - untrusted HTML, Markdown, tool output, and generated content are encoded, sanitized, or rendered in a constrained component.
  • R-TENANT-1 - shared tenant resources have explicit isolation checks and accepted risk.
  • R-CI-1 - production-mutating workflows use minimum permissions, protected environments, and scoped deployment credentials.
  • R-LOG-1 - security-sensitive failures and mutating operations leave enough evidence to investigate without logging secrets.

Reports and scans should cite this pinned edition URL: https://vibecodeqa.online/standards/security/v1/

Reference baseline