https://github.com/valango/security
Some basic rules of survival for developers
https://github.com/valango/security
Last synced: about 2 months ago
JSON representation
Some basic rules of survival for developers
- Host: GitHub
- URL: https://github.com/valango/security
- Owner: valango
- Created: 2026-05-02T13:18:50.000Z (3 months ago)
- Default Branch: master
- Last Pushed: 2026-05-02T13:43:43.000Z (3 months ago)
- Last Synced: 2026-05-02T15:27:27.913Z (3 months ago)
- Size: 1.95 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# Security Rules for Software Development
_The rules are not exhaustive and apply to javascript/typescript technologies in the first place.
Be aware that other ecosystems (Python, GoLang, ...) are under attack as well._
NOTE: for better readability the more in-depth [comments](#comments) are in the end of the document.
## Rules and Requirements
### Using Package Managers
Use only `npm` or `pnpm`. If you need anything else, consult the IT guys first!
Keep your package managers up to date, but don't install updates which are less than 3 days old.
Regularly run _**audit** command_ on your active repositories.
1. Never delete an existing `package-lock.json` or `pnpm-lock.yaml` file. This file ensures that the exact same versions
of
dependencies are installed when you re-install your project.
2. Prevent package auto-run: run
```sh
$ npm config set -g ignore-scripts true # or
$ pnpm config set ignore-scripts true
```
2. Make sure there is a .npmrc or .pnpmrc file in your project directory and it contains a line:
`ignore-scripts=true`
The pnpm provides additional quite flexible configuration options, see https://pnpm.io/settings#onlybuiltdependencies
3. Always check that none of package or configuration files contain any access keys, URLs etc., unless these are really
irrelevant.
4. _**Do not** install_ the _default version of any package_. Always use a specific version.
Check the package's release history and security advisories.
The same rules apply to updating your project dependencies, too.
Infected uploads are usually detected in about a week or so.
Instead of `npm install something` use `npm install something@1.2.3`.
5. Always use `npm ci` and NOT `npm install` when re-installing dependencies of a project.
With `pnpn` use
`pnpm install --frozen-lockfile`
6. Do not use `npm audit fix` or `pnpn audit --fix`, because the latest versions might be installed w/o checking.
### Preventing AI Tools from Stealing or Compromising Your Data
The https://claude.ai claims that _Claude.app_ / _Claude.exe_ is "safe", but this might not be true.
Hereby we speak of command line tools - the things you can run from the terminal window command line.
#### MacOS: Run Claude Code in a Docker Container
I followed https://github.com/trailofbits/claude-code-devcontainer/tree/main w/o installing OrbStack or Colima.
Tried the "Pattern A" -> Terminal. Installation was quite lengthy, but it worked. Need to check the "Pattern B".
_This looks promising_: https://docs.docker.com/ai/sandboxes/ , but it requires at least **MacOS.26 Tahoe**.
#### MacOS: Create a Special User Account
Log into it (or `su -` into it) when running Claude Code. That user has
its own home directory, its own (empty) Keychain, no access to your real `~/.ssh/`, no AWS credentials. Project files
live in a directory you've chmod'd to be readable by both users, or you symlink/bind-mount them in.
_**EDIT@0503**: all that is not that simple as it seems and is not proved yet._
#### Windows: Use Docker Sandbox:
This could work: https://docs.docker.com/ai/sandboxes (not tested yet).
Running tools in VM could be a solution too.
## Comments
**Q**: Is it secure to run any software in a Web Browser window?
**A**: No. Malware and infected web sites have always been there.
People think local files can't be read by a web browser, but they can.
Running AI web apps in a browser is just _moderately safer_ than running installed versions.
### Using package managers
There are some prominent attack vectors known:
1. an infected 3-rd party package may contain a script in its package.json file that will run automatically during
installation. A malware may harvest all passwords, API keys, access tokens from your system, send them to somebody
and/or try to exploit those immediately.
2. The code itself may be infected as well. In this case, the malware activates when the package or your code using it,
is executed.
3. If you are a developer owning any packages in public repos like npmjs.com, a malware may publish new infected
releases of your existing packages. Usually only the release number will differ and in some cases the same release
can be replaced.
**Q**: Why do I need play with .pnpmrc file if I already set the global options?
**A**: When deploying your stuff to hosting, your global settings will not follow. Those are only your local safeguards.
### Preventing AI Tools from Stealing or Compromising Your Data
_Any software installed on your system **can steal or compromise your data**.
If this is not bad enough, then so can do any browser plugin/add-on, too._
The main known attack vectors are:
1. A tool in use gets auto-updated to a new version that contains a malicious code (unlikely).
2. A _command insertion_ type attack to a model / agent you are using.
3. A spyware installed or prepared for during installation of a tool.
Example: https://www.thatprivacyguy.com/blog/anthropic-spyware 😨
## References
* https://pnpm.io/supply-chain-security
* https://developer.chrome.com/docs/capabilities/web-apis/file-system-access