From 6cae3b5399adbdd6ed353d45d258d708caea6c92 Mon Sep 17 00:00:00 2001 From: mykhaylob Date: Tue, 1 Sep 2026 17:10:48 +0300 Subject: [PATCH] chore: add information-exposure policy (AGENTS.md + Cursor rule) --- .cursor/rules/info-exposure.mdc | 16 ++++++++++++++++ AGENTS.md | 31 +++++++++++++++++++++++++++++++ 2 files changed, 47 insertions(+) create mode 100644 .cursor/rules/info-exposure.mdc create mode 100644 AGENTS.md diff --git a/.cursor/rules/info-exposure.mdc b/.cursor/rules/info-exposure.mdc new file mode 100644 index 0000000..7b39de9 --- /dev/null +++ b/.cursor/rules/info-exposure.mdc @@ -0,0 +1,16 @@ +--- +description: "Public-repo information exposure policy: what never goes into commits, PRs, code, or fixtures" +globs: [] +alwaysApply: true +--- + +# Information Exposure (public repository) + +This repository is public. Hard rules for everything written here — commit messages, PR text, code, docs, and fixtures: + +- NO internal content: ticket/Slack/meeting excerpts, customer or organization names, employee emails, internal URLs (Linear, Notion, Slack, Grain), internal hostnames, AWS account IDs, or infrastructure details. +- NO security detail in commit/PR text: never name the vulnerability class or exploit path; use neutral wording ("harden input validation"). +- NO secrets anywhere: tokens, API keys, JWTs, cookies, connection strings — including test fixtures and recorded HTTP mocks. +- NO AI/agent attribution: no `Co-authored-by` / `Generated-with` trailers; commit as the user's configured git identity. + +Full policy: see `AGENTS.md`. diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..069be7e --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,31 @@ +# Agent Guidelines + +## Public repository — information exposure policy + +This repository is public. Everything in it — source code, commit messages, PR titles and bodies, issues, and the CHANGELOG — is world-readable. Follow these rules for anything you write here. + +### Commits and pull requests + +- Describe what changed and why it matters to users of the CLI, not the internal discussion behind it. +- Never paste content from internal tickets, Slack threads, meeting notes, or call recordings. +- Never mention customer or organization names, employee names or emails, or internal URLs (Linear, Notion, Slack, Grain). +- Never reference internal hostnames, AWS account IDs, environment names, or infrastructure topology. + +### Security wording + +- Never name a vulnerability class, exploit path, or impact in commit or PR text (e.g., "fix injection in X endpoint"). +- Use neutral wording instead ("harden input validation", "improve request handling") and keep the details in the private tracker. + +### Secrets + +- Never include tokens, API keys, JWTs, cookies, or connection strings anywhere: messages, code, examples, test fixtures, or recorded HTTP mocks. +- If a secret lands in history, treat it as compromised: rotate it and tell the maintainers. Deleting the line is not enough. + +### No AI attribution + +- No `Co-authored-by`, `Generated-with`, `Made-with`, or any other agent/tool trailer in commits or PRs. +- Commits are authored by the user's configured git identity. Never change `git config user.name` / `user.email`. + +### Source is public too + +The same rules apply inside the code: comments, docstrings, error strings, and CHANGELOG entries. Examples in the README and tests use fake organization names and `example.com` emails — never real customer data.