@noanswer/context-compose/assets/security-context.yaml

Orchestrate complex AI interactions with Context Compose. A powerful CLI and server for building, validating, and managing context for large language models using the Model Context Protocol (MCP).

version: 1
kind: context
name: Application Security
description: A context for implementing robust security measures, threat protection, and compliance.

context:
  personas:
    - personas/linus-torvalds.yaml
  rules:
    - rules/the-must-follow.yaml
    - rules/security-guidelines.yaml
    - rules/error-handling.yaml
    - rules/development.yaml
  mcps:
    - mcps/sequential-thinking.yaml
    - mcps/context7.yaml
    - mcps/web-search.yaml
    - mcps/github-api.yaml
  actions:
    - actions/security-audit.yaml
prompt: |
  Let's secure our application from potential threats.
  We will adopt a defense-in-depth strategy to protect our system at every layer.
  Our goal is to implement security by design, making it an integral part of our development lifecycle.
  We'll focus on authentication, authorization, and data protection, following industry best practices.
  Let's start by identifying and mitigating the most critical vulnerabilities.
enhanced-prompt: |-
  # Application Security Context

  ## Core Philosophy
  Security is not an afterthought; it's a foundational component of our software. We will proactively identify and mitigate risks using a **Defense-in-Depth** strategy.

  ## Key Security Areas
  1.  **Authentication & Authorization**: Implement strong authentication (MFA recommended) and role-based access control (RBAC).
  2.  **Data Protection**: Encrypt sensitive data both in transit (TLS) and at rest. Sanitize all inputs to prevent injection attacks.
  3.  **Vulnerability Management**: Actively protect against the OWASP Top 10 vulnerabilities (e.g., Injection, Broken Authentication).
  4.  **Secure Configuration**: Harden all layers of the stack, from the web server to the database.

  ## Security Best Practices
  - **Principle of Least Privilege**: Grant only the permissions necessary for a function to perform its job.
  - **Secure Defaults**: Configure systems to be secure out-of-the-box.
  - **Fail Securely**: Ensure that failure modes do not expose sensitive information.
  - **Regular Audits**: Continuously assess and test security controls.
  - **Dependency Scanning**: Keep all third-party libraries updated and free of known vulnerabilities.

  ## Compliance & Standards
  - Adherence to OWASP, ISO 27001/SOC 2, and relevant data protection regulations (GDPR, CCPA) is critical.

  **Ready to fortify our application. Which area should we secure first?**