---
name: compliance-awareness
description: "Map generated code against OWASP, CWE, and SANS Top 25 controls for traceability — Applies to: when generating code in regulated environments; when writing audit-relevant comments or documentation; when refactoring code that crosses compliance boundaries (PII, PHI, PCI scope)"
---

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. -->
<!-- Do not edit by hand; the source of truth is skills/compliance-awareness/SKILL.md. -->

# Compliance Awareness

Map generated code against OWASP, CWE, and SANS Top 25 controls for traceability

## ALWAYS

- Tag functions that handle PII / PHI / PCI data with a comment indicating the classification (e.g. `// classification: PII`).
- Log audit events for security-relevant actions (login, permission change, data export, admin operations) — log who, what, when, NOT the sensitive payload.
- Identify the CWE / OWASP category for security-relevant code in comments when the team's convention is to include traceability (`// addresses CWE-79 — XSS`).
- For PCI scope, segregate card-data-handling code into clearly-named modules so scope boundaries are visible.
- For HIPAA workloads, prefer encryption at rest AND in transit, with documented key management.

## NEVER

- Include PII / PHI / PCI in log messages, error messages, or telemetry events.
- Store payment card numbers, CVVs, or full magnetic stripe data outside of a PCI DSS-compliant tokenization service.
- Mix PII-handling code into general utility modules without explicit classification.
- Generate code that processes EU residents' personal data without considering GDPR obligations (right to erasure, data minimization, lawful basis).
- Suggest workarounds that bypass compliance controls "for development" — these workarounds always leak into production.

## KNOWN FALSE POSITIVES

- Logs of *types* of data accessed ("user accessed claim record") are usually fine; the rule is against logging the *contents* of sensitive fields.
- Test fixtures using clearly fake data (`555-0100` phone numbers, `4111-1111-1111-1111` PAN, `John Doe`) are not PII.
- Audit log retention is intentionally long (often years) and should not be filtered by general data-retention sweeps.