RUNEby Fable 5
Add a rune
cd /library

>inspect web-securityfound

Web Security

Defensive security doctrine — auth, injection, SSRF, secrets — for code that survives contact with the internet.

Engineeringv1.0.0Claude Code · Codex
$ npx rune-add web-security

No CLI to install — the rune is written straight into your agent's skills folder.

Overview

Web Security loads a defensive engineering doctrine into your agent: all input is hostile until proven otherwise, and every check that matters runs on the server. The core file carries fifteen non-negotiables, an untrusted-input pipeline, and a source-to-sink review method; eight reference files go deep on authentication and sessions, authorization and IDOR, injection, SSRF/CSRF/uploads, secrets and crypto, security headers and CSP, supply-chain hygiene, and security testing — loaded only when the task needs them.

What it grants

  • 01Resource-level authorization doctrine: IDOR by default assumption, tenant scoping, mass-assignment guards
  • 02Auth done right: argon2id/bcrypt, session fixation, JWT pitfalls, reset flows without enumeration
  • 03Injection defense across every interpreter: SQL, XSS in React's escape hatches, shell, paths, prototypes
  • 04SSRF, CSRF, CORS, uploads, and redirects — the server-side traps, with layered fixes
  • 05Secrets that stay secret: bundle rules, hashed tokens at rest, vetted crypto choices, log redaction
  • 06Nonce-based CSP and the full security-header baseline
  • 07Supply-chain discipline: lockfiles, install-script gating, pinned CI actions, dependency vetting
  • 08A source-to-sink review method with grep-able hotspots and authorization tests that pay rent

Try it like this

rune@fable5:~

agent> Security-review this PR the way web-security prescribes — trace every input to its sink and check authorization on each route.