coder-system-design-security

<when_to_use> Designing or reviewing architecture with user, service, or data trust boundaries Handling sensitive data, auth flows, secrets, or third-party dependencies Need explicit security gates before implementation or release </when_to_use>

<input_requirements> System context and trust boundaries Data classification and retention rules AuthN/AuthZ model and identity providers Compliance and risk constraints Deployment and supply-chain context </input_requirements>

<security_baseline> Threat model exists for critical paths and is updated on architecture changes Authorization is deny-by-default and checked server-side per request Secrets are centrally managed with rotation and audit trails Sensitive data classes are mapped to handling and access policies Encryption in transit and at rest is enforced with key lifecycle controls Supply chain has dependency governance and artifact provenance controls Logging includes security-relevant events with redaction of sensitive values </security_baseline>

<decision_framework> Classify data and business impact Map trust boundaries and attacker paths Select control level (baseline, enhanced, critical) Record decisions and residual risk in architecture notes Attach verification gates to delivery pipeline </decision_framework>

<quality_rules> No implicit trust based on network location alone No plaintext secret handling in code, logs, or build outputs No privileged operation without auditable identity and authorization No release of critical path without security verification evidence </quality_rules>

<do_not> Do not rely only on edge/gateway auth checks Do not keep long-lived credentials without rotation policy Do not log tokens, passwords, private keys, or sensitive PII Do not skip threat-model update for major architecture changes </do_not>

<output_requirements> Security checklist result with pass/fail and evidence Decision summary with selected controls and rationale Open risks with owner and mitigation plan Required runtime monitoring and incident hooks </output_requirements>