include new claude rules#2800
Merged
Merged
Conversation
tharindu1st
requested review from
AnuGayan,
Arshardh,
CrowleyRajapakse,
HeshanSudarshana,
HiranyaKavishani,
Induwara04,
Krishanx92,
PasanT9,
Piumal1999,
RakhithaRR,
Tharsanan1,
Thushani-Jayasekera,
VirajSalaka,
ashera96,
chamilaadhi,
dushaniw,
hisanhunais,
lasanthaS,
malinthaprasan,
pubudu538,
renuka-fernando,
senthuran16,
tgtshanika,
tharikaGitHub and
thivindu
as code owners
July 23, 2026 04:56
Contributor
|
Warning Review limit reached
Next review available in: 39 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (15)
📝 WalkthroughWalkthroughThe PR expands security rule documentation with fail-closed authentication, sensitive-handle protection, bounded decompression, xDS and network hardening, CORS and SSRF validation, and revised JavaScript and Go security examples. ChangesSecurity rule hardening
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
renuka-fernando
previously approved these changes
Jul 23, 2026
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 16
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/rules/authentication_authorization.md:
- Around line 785-810: The ValidateAuthConfig function must honor
AuthConfig.Disable as an explicit opt-out: when it is true, allow startup
without configured authenticators and preserve the documented
warning-on-every-request behavior. Keep the existing validation for enabled
authentication methods and reject missing authenticators only when Disable is
false.
- Around line 1208-1215: Update AuthMiddleware so ResolveRouteBinding failures
are not universally returned as 403 Forbidden. Allow unbound requests to
continue through normal routing/not-found handling, or apply deny-by-default
only when the request is confirmed to target a protected namespace; preserve
forbidden responses for resolvable protected routes that fail authorization.
- Around line 1084-1088: Make RestAPIService.Update enforce immutable mode
atomically with db.UpdateAPI: protect the mode check and database mutation with
the same transaction, conditional update, or shared lock so a mode change cannot
allow the update to commit. Preserve ErrImmutableModeActive when immutable mode
is enabled and the existing successful update behavior otherwise.
- Around line 1000-1008: The EnsureInitialAdminCredential flow must persist and
reload the generated admin credential instead of returning solely because
initial-admin-password exists. Load the persisted bcrypt user hash into
cfg.Users on subsequent boots, and atomically persist both the password state
and associated user data when generating credentials; only return early when
cfg.Users is already configured or the stored state is valid and successfully
restored.
- Around line 871-878: Update VerifyManagementToken’s jwt.ParseWithClaims key
callback to validate the token’s signing method before returning idpPublicKey.
Reject none and symmetric algorithms, and accept only the configured asymmetric
algorithms (RS256/RS384/RS512, ES256/ES384/ES512, and EdDSA), with an
appropriate key-type check; preserve the existing audience and issuer
validation.
- Around line 949-955: Update NewAdminMux and its AuthMiddleware invocation to
match the documented []Authenticator contract, preferably by passing the admin
authenticator as a collection; if the surrounding API requires a single value,
add an explicit adapter that produces the documented collection type before
calling AuthMiddleware.
- Around line 863-868: Update the existing ValidateAuthConfig validation rather
than redeclaring or replacing it. Preserve the BasicAuth Users == 0 check and
the fail-open guard for disabled BasicAuth and IDP, then add a required-startup
validation that rejects enabled IDP configuration when either ExpectedAudience
or Issuer/IssuerURL is missing. Ensure both JWT scope fields fail closed before
authentication starts.
In @.claude/rules/error-handling.md:
- Around line 42-43: Update the error-handling guidance and its referenced
examples to avoid logging raw sensitive handles with `%q` in standard
internal-error logs. Use a redacted or keyed-hash identifier instead, and only
permit the full handle through a tightly access-controlled audit sink when
strictly required; apply the same change to the additional referenced sections.
In @.claude/rules/file-access.md:
- Around line 323-328: Update StreamDecompressBounded to determine the declared
or observed compressed size before or during streaming and apply the same
maximum-ratio ceiling calculation used by the buffered decompression path.
Enforce that ratio-based limit alongside the existing cumulative output cap,
preserving support for chunked or unknown-length streams.
In @.claude/rules/go-control-plane-xds-security.md:
- Around line 29-31: The “Disable Runtime Modification” guidance incorrectly
recommends a read-only flags_path mount. Update that directive to explain that
flags_path controls startup flag files, while layered_runtime controls the
runtime stack; require a non-empty layered_runtime configuration that omits
admin_layer so /runtime_modify returns 503.
- Around line 109-115: Check the boolean result of pool.AppendCertsFromPEM in
the TLS client-CA setup and return a descriptive error when it is false. Keep
the existing file-read error handling and only proceed with the populated pool
when at least one valid certificate was appended.
In @.claude/rules/go-cors-validation.md:
- Around line 82-85: Update the CORS validation rule and its associated examples
around AllowedOrigins and isOriginAllowed to define wildcard behavior
consistently. Either implement "*" as a true wildcard that permits any origin
and emits Access-Control-Allow-Origin: * when credentials are disabled, or
remove wildcard support from the rule and example; preserve the existing
rejection of wildcard origins when allowCredentials is enabled.
- Around line 21-23: Update the credentials policy and its associated checklist
and validation references to match the implementation: allow allowCredentials:
true with multiple explicitly allowlisted exact origins, while still rejecting
wildcard and unanchored or regex-based origins. Revise the rule text and
sections covering the listed credential-validation guidance; do not add a
single-origin restriction to Validate.
In @.claude/rules/go-network-service-hardening.md:
- Around line 25-26: Revise the “Cap Per-Request Resource Use Inside the Pool
Too” guidance so resource.setrlimit is described as a per-worker process limit,
not a per-request limit. If per-request enforcement is required, specify
per-invocation isolation such as a separate sandboxed process or container with
an enforced resource budget.
- Around line 28-30: The guidance in “Add Jitter to Any Fixed-Interval Poll
Against a Shared Upstream” uses invalid and unsafe jitter examples and places
jitter after the fetch. Update the example to use supported random-duration
construction, validate non-positive and minimal intervals before calculating
jitter, and compute and wait for the jittered delay before every fetch so
restarted replicas do not poll in lockstep.
In @.claude/rules/ssrf-prevention.md:
- Around line 39-44: Clarify the “One Shared Validation Helper” guidance to
define both enforcement layers: shared parse-time URL and scheme validation for
every validator, and shared dial-time private-IP/metadata protection for every
outbound client. Update the ValidateCallbackURL example and related wording so
it may rely on SafeDialer for IP enforcement while requiring all outbound
transports to use that shared guarded dialer.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: e8020685-85d2-485c-b0c4-eb635ca03bf6
📒 Files selected for processing (7)
.claude/rules/authentication_authorization.md.claude/rules/error-handling.md.claude/rules/file-access.md.claude/rules/go-control-plane-xds-security.md.claude/rules/go-cors-validation.md.claude/rules/go-network-service-hardening.md.claude/rules/ssrf-prevention.md
tharindu1st
force-pushed
the
aws-authentication
branch
from
July 23, 2026 06:47
ed1d252 to
7135da3
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
.claude/rules/go-cors-validation.md (1)
101-103: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winCompile validated origin patterns once.
isOriginAllowedrecompiles every configured pattern for every request and usesMustCompile, which can panic if validation is bypassed or configuration changes. Store compiled patterns during policy validation, or useregexp.Compileand fail closed.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/rules/go-cors-validation.md around lines 101 - 103, Update the policy validation and isOriginAllowed flow so configured origin patterns are compiled once and reused for each request, rather than calling regexp.MustCompile inside the request loop. Store the compiled regexes with the validated policy, or use regexp.Compile during validation and reject invalid patterns; ensure runtime matching fails closed without panicking if validation is bypassed or configuration changes.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/rules/file-access.md:
- Line 46: In the built-in template functions directive, replace the term
“builtin” with “built-in” while preserving the surrounding wording and security
requirements.
In @.claude/rules/js-error-handling.md:
- Line 56: Update the anti-pattern comments to match the shown snippets: in
.claude/rules/js-error-handling.md lines 56-56, either add the distinct
wrong-password response branch or remove the claim; in
.claude/rules/js-file-access.md lines 61-62, describe the behavior as persisting
a client-controlled filename unless the code is changed to store an actual path;
and in .claude/rules/js-output-encoding-xss.md lines 56-59, describe the snippet
as serving a stored SVG upload inline.
In @.claude/rules/js-post-quantum-cryptography.md:
- Around line 70-74: Update the rejected AES example around the key and cipher
declarations so the key length matches the aes-256-gcm algorithm, while
retaining the intentionally reused staticNonce. Add a second encryption using
the same key and nonce so the nonce-reuse weakness is executable and clearly
demonstrated.
In @.claude/rules/post-quantum-cryptography.md:
- Line 69: Update the standalone KEM example around the kyber768 encapsulation
to generate a public key before use, then call the exported scheme API via
kyber768.Scheme().Encapsulate(pub). Keep the example intentionally non-hybrid
and preserve its existing shared-secret flow.
---
Nitpick comments:
In @.claude/rules/go-cors-validation.md:
- Around line 101-103: Update the policy validation and isOriginAllowed flow so
configured origin patterns are compiled once and reused for each request, rather
than calling regexp.MustCompile inside the request loop. Store the compiled
regexes with the validated policy, or use regexp.Compile during validation and
reject invalid patterns; ensure runtime matching fails closed without panicking
if validation is bypassed or configuration changes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 9d292f0a-407f-43fc-9ac7-6be52780a8cb
📒 Files selected for processing (15)
.claude/rules/authentication_authorization.md.claude/rules/error-handling.md.claude/rules/file-access.md.claude/rules/go-control-plane-xds-security.md.claude/rules/go-cors-validation.md.claude/rules/go-network-service-hardening.md.claude/rules/js-authentication-authorization.md.claude/rules/js-error-handling.md.claude/rules/js-file-access.md.claude/rules/js-output-encoding-xss.md.claude/rules/js-post-quantum-cryptography.md.claude/rules/js-ssrf-prevention.md.claude/rules/js-xxe-xml-processing.md.claude/rules/post-quantum-cryptography.md.claude/rules/ssrf-prevention.md
🚧 Files skipped from review as they are similar to previous changes (5)
- .claude/rules/go-control-plane-xds-security.md
- .claude/rules/go-network-service-hardening.md
- .claude/rules/ssrf-prevention.md
- .claude/rules/error-handling.md
- .claude/rules/authentication_authorization.md
tharindu1st
force-pushed
the
aws-authentication
branch
from
July 23, 2026 08:31
7135da3 to
b9af6d7
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/rules/file-access.md:
- Around line 287-306: Update DecompressBoundedGzip and DecompressionConfig
validation to reject nonpositive MaxDecompressedBytes and MaxRatio, and reject
unknown or negative compressedSize values according to the API contract.
Calculate ratioLimit and ceiling using overflow-safe checked arithmetic,
including the ceiling+1 limit, before creating the io.LimitReader; return
descriptive errors for invalid inputs or overflow.
In @.claude/rules/go-control-plane-xds-security.md:
- Line 7: Revise the security claims in the document’s opening statement and the
admin-interface guidance around the referenced lower section so they do not
unconditionally state that `/config_dump` exposes TLS private keys. Describe the
sensitive configuration and live mutation risks accurately, and mention
private-key exposure only when explicitly tied to untyped or inline output
paths.
- Around line 96-99: Align NewEnvoyXDSServer and OnStreamOpen so their TLS
requirements match: either reject plaintext configuration unconditionally or
explicitly propagate a validated loopback-only plaintext mode to authorization.
Update OnStreamOpen to accept that mode only for validated loopback binds while
continuing to require TLS/mTLS for all other connections, ensuring every allowed
startup configuration can serve xDS.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 5e240d05-82b1-4086-98e7-50cb68aa286b
📒 Files selected for processing (15)
.claude/rules/authentication_authorization.md.claude/rules/error-handling.md.claude/rules/file-access.md.claude/rules/go-control-plane-xds-security.md.claude/rules/go-cors-validation.md.claude/rules/go-network-service-hardening.md.claude/rules/js-authentication-authorization.md.claude/rules/js-error-handling.md.claude/rules/js-file-access.md.claude/rules/js-output-encoding-xss.md.claude/rules/js-post-quantum-cryptography.md.claude/rules/js-ssrf-prevention.md.claude/rules/js-xxe-xml-processing.md.claude/rules/post-quantum-cryptography.md.claude/rules/ssrf-prevention.md
🚧 Files skipped from review as they are similar to previous changes (9)
- .claude/rules/js-ssrf-prevention.md
- .claude/rules/js-xxe-xml-processing.md
- .claude/rules/js-output-encoding-xss.md
- .claude/rules/js-authentication-authorization.md
- .claude/rules/go-network-service-hardening.md
- .claude/rules/error-handling.md
- .claude/rules/ssrf-prevention.md
- .claude/rules/post-quantum-cryptography.md
- .claude/rules/authentication_authorization.md
tharindu1st
force-pushed
the
aws-authentication
branch
from
July 23, 2026 10:19
b9af6d7 to
bd59c88
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/rules/js-post-quantum-cryptography.md:
- Around line 66-68: Update the signLegacy example to explicitly use the
RSA-SHA256 algorithm and an RSA private-key symbol or annotation, making the
legacy signature clearly quantum-vulnerable while preserving the existing
signing flow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: f3d25a91-7415-4fd9-9ce1-b7d2f1f053e0
📒 Files selected for processing (15)
.claude/rules/authentication_authorization.md.claude/rules/error-handling.md.claude/rules/file-access.md.claude/rules/go-control-plane-xds-security.md.claude/rules/go-cors-validation.md.claude/rules/go-network-service-hardening.md.claude/rules/js-authentication-authorization.md.claude/rules/js-error-handling.md.claude/rules/js-file-access.md.claude/rules/js-output-encoding-xss.md.claude/rules/js-post-quantum-cryptography.md.claude/rules/js-ssrf-prevention.md.claude/rules/js-xxe-xml-processing.md.claude/rules/post-quantum-cryptography.md.claude/rules/ssrf-prevention.md
🚧 Files skipped from review as they are similar to previous changes (10)
- .claude/rules/js-ssrf-prevention.md
- .claude/rules/js-xxe-xml-processing.md
- .claude/rules/js-output-encoding-xss.md
- .claude/rules/go-control-plane-xds-security.md
- .claude/rules/error-handling.md
- .claude/rules/js-authentication-authorization.md
- .claude/rules/post-quantum-cryptography.md
- .claude/rules/ssrf-prevention.md
- .claude/rules/go-network-service-hardening.md
- .claude/rules/authentication_authorization.md
tharindu1st
force-pushed
the
aws-authentication
branch
from
July 23, 2026 10:29
bd59c88 to
683c7af
Compare
tharindu1st
force-pushed
the
aws-authentication
branch
from
July 23, 2026 10:39
683c7af to
df7408b
Compare
Krishanx92
approved these changes
Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
include new claude rules