mirror of
https://github.com/affaan-m/everything-claude-code.git
synced 2026-03-30 21:53:28 +08:00
d70bab85e3
- AGENTS.md: universal cross-tool file read by Claude Code, Cursor, Codex, and OpenCode - .cursor/: 15 hook events via hooks.json, 16 hook scripts with DRY adapter pattern, 29 rules (9 common + 20 language-specific) with Cursor YAML frontmatter - .codex/: reference config.toml, Codex-specific AGENTS.md supplement, 10 skills ported to .agents/skills/ with openai.yaml metadata - .opencode/: 3 new tools (format-code, lint-check, git-summary), 3 new hooks (shell.env, experimental.session.compacting, permission.ask), expanded instructions, version bumped to 1.6.0 - README: fixed Cursor section, added Codex section, added cross-tool parity table - install.sh: now copies hooks.json + hooks/ for --target cursor
1.0 KiB
1.0 KiB
description, globs, alwaysApply
| description | globs | alwaysApply | ||
|---|---|---|---|---|
| Swift security extending common rules |
|
false |
Swift Security
This file extends the common security rule with Swift specific content.
Secret Management
- Use Keychain Services for sensitive data (tokens, passwords, keys) -- never
UserDefaults - Use environment variables or
.xcconfigfiles for build-time secrets - Never hardcode secrets in source -- decompilation tools extract them trivially
let apiKey = ProcessInfo.processInfo.environment["API_KEY"]
guard let apiKey, !apiKey.isEmpty else {
fatalError("API_KEY not configured")
}
Transport Security
- App Transport Security (ATS) is enforced by default -- do not disable it
- Use certificate pinning for critical endpoints
- Validate all server certificates
Input Validation
- Sanitize all user input before display to prevent injection
- Use
URL(string:)with validation rather than force-unwrapping - Validate data from external sources (APIs, deep links, pasteboard) before processing