# Security Policy (Hausa)

🌐 **Languages:** 🇺🇸 [English](../../../SECURITY.md) · 🇪🇹 [am](../am/SECURITY.md) · 🇸🇦 [ar](../ar/SECURITY.md) · 🇦🇿 [az](../az/SECURITY.md) · 🇧🇬 [bg](../bg/SECURITY.md) · 🇧🇩 [bn](../bn/SECURITY.md) · 🇧🇦 [bs](../bs/SECURITY.md) · 🇨🇿 [cs](../cs/SECURITY.md) · 🇩🇰 [da](../da/SECURITY.md) · 🇩🇪 [de](../de/SECURITY.md) · 🇬🇷 [el](../el/SECURITY.md) · 🇪🇸 [es](../es/SECURITY.md) · 🇪🇪 [et](../et/SECURITY.md) · 🇮🇷 [fa](../fa/SECURITY.md) · 🇫🇮 [fi](../fi/SECURITY.md) · 🇫🇷 [fr](../fr/SECURITY.md) · 🇮🇪 [ga](../ga/SECURITY.md) · 🇮🇳 [gu](../gu/SECURITY.md) · 🇮🇱 [he](../he/SECURITY.md) · 🇮🇳 [hi](../hi/SECURITY.md) · 🇭🇷 [hr](../hr/SECURITY.md) · 🇭🇺 [hu](../hu/SECURITY.md) · 🇦🇲 [hy](../hy/SECURITY.md) · 🇮🇩 [id](../id/SECURITY.md) · 🇳🇬 [ig](../ig/SECURITY.md) · 🇮🇹 [it](../it/SECURITY.md) · 🇯🇵 [ja](../ja/SECURITY.md) · 🇬🇪 [ka](../ka/SECURITY.md) · 🇰🇭 [km](../km/SECURITY.md) · 🇮🇳 [kn](../kn/SECURITY.md) · 🇰🇷 [ko](../ko/SECURITY.md) · 🇱🇹 [lt](../lt/SECURITY.md) · 🇱🇻 [lv](../lv/SECURITY.md) · 🇮🇳 [ml](../ml/SECURITY.md) · 🇮🇳 [mr](../mr/SECURITY.md) · 🇲🇾 [ms](../ms/SECURITY.md) · 🇲🇹 [mt](../mt/SECURITY.md) · 🇲🇲 [my](../my/SECURITY.md) · 🇳🇵 [ne](../ne/SECURITY.md) · 🇳🇱 [nl](../nl/SECURITY.md) · 🇳🇴 [no](../no/SECURITY.md) · 🇮🇳 [or](../or/SECURITY.md) · 🇮🇳 [pa](../pa/SECURITY.md) · 🇵🇭 [phi](../phi/SECURITY.md) · 🇵🇱 [pl](../pl/SECURITY.md) · 🇵🇹 [pt](../pt/SECURITY.md) · 🇧🇷 [pt-BR](../pt-BR/SECURITY.md) · 🇷🇴 [ro](../ro/SECURITY.md) · 🇷🇺 [ru](../ru/SECURITY.md) · 🇱🇰 [si](../si/SECURITY.md) · 🇸🇰 [sk](../sk/SECURITY.md) · 🇸🇮 [sl](../sl/SECURITY.md) · 🇷🇸 [sr](../sr/SECURITY.md) · 🇸🇪 [sv](../sv/SECURITY.md) · 🇰🇪 [sw](../sw/SECURITY.md) · 🇮🇳 [ta](../ta/SECURITY.md) · 🇮🇳 [te](../te/SECURITY.md) · 🇹🇭 [th](../th/SECURITY.md) · 🇹🇷 [tr](../tr/SECURITY.md) · 🇺🇦 [uk-UA](../uk-UA/SECURITY.md) · 🇵🇰 [ur](../ur/SECURITY.md) · 🇺🇿 [uz](../uz/SECURITY.md) · 🇻🇳 [vi](../vi/SECURITY.md) · 🇳🇬 [yo](../yo/SECURITY.md) · 🇨🇳 [zh-CN](../zh-CN/SECURITY.md) · 🇹🇼 [zh-TW](../zh-TW/SECURITY.md)

---

## Bayar da Rahoton Raunukan Tsaro

Idan ka gano wani raunin tsaro a OmniRoute, da fatan za ka bayar da rahotonsa cikin alhaki:

1. **KADA KA** buɗe batun GitHub na jama'a
2. Yi amfani da [GitHub Security Advisories](https://github.com/diegosouzapw/OmniRoute/security/advisories/new)
3. Haɗa da: bayani, matakan sake haifar da matsalar, da tasirin da ka iya faruwa

## Jadawalin Amsa

| Mataki            | Manufa                         |
| ----------------- | ------------------------------ |
| Tabbatar da karɓa | Awanni 48                      |
| Tantancewa        | Kwanakin aiki 5                |
| Fitar da Gyara    | Kwanakin aiki 14 (mai tsanani) |

## Nau'ikan da Ake Tallafawa

| Nau'i   | Matsayin Tallafi                                 |
| ------- | ------------------------------------------------ |
| 3.9.x   | 🗓️ An tsara — layin LTS (`stable/v3`), duba ƙasa |
| 3.8.x   | ✅ Mai aiki                                      |
| 3.7.x   | ✅ Tsaro                                         |
| < 3.7.0 | ❌ Ba a tallafawa                                |

## Tsawon lokacin tallafin LTS (v3.9.x)

Bayan 3.8.59 nau'i na gaba shi ne **3.9.0**, wanda zai buɗe layin tallafi na dogon lokaci a reshen
`stable/v3` (duba [`ROADMAP.md`](ROADMAP.md) → "Mataki na 3 — v3.9.0 LTS").

- **Abin da `stable/v3` ke karɓa:** gyaran kurakurai, facin tsaro da sabuntawar masu samarwa. Sabbin
  fasaloli suna zuwa tashar v4; layin LTS yana ba da fifiko ga kwanciyar hankali. `npm install omniroute`
  (`latest` dist-tag) zai ci gaba da kasancewa a v3 a duk tsawon zagayen v4.
- **Tsawon lokacin:** `<T-GAP-3: shawarar mai shi tana jiran amincewa — duba ROADMAP.md>`. Har yanzu
  **ba a yanke shawara ba** game da tsawon lokacin bayan fitowar v4.0 GA (lokacin da `latest` zai koma v4);
  za a sabunta wannan sashe idan mai kula ya sanar da shi. Har sai lokacin, kada a ɗauka cewa akwai ranar ƙarewa.
- **Bayar da rahoton rauni a layin LTS:** yi amfani da wannan tasha kamar kowane nau'i —
  [GitHub Security Advisory](https://github.com/diegosouzapw/OmniRoute/security/advisories/new) mai zaman kansa,
  ba batun jama'a ba. Faɗi nau'in da ka gwada (misali `3.9.2`); gyare-gyare suna sauka a
  `stable/v3` sannan a tura su gaba zuwa v4.
- **Ma'aunin tsaro a lokacin ƙaddamar da LTS:** an rubuta yanayin na'urar bincike da aka auna, kariyar hanya da
  hujjojin bayanan shaidar jama'a a cikin
  [`docs/security/LTS_SECURITY_BASELINE.md`](docs/security/LTS_SECURITY_BASELINE.md).

---

## Tsarin Gine-ginen Tsaro

OmniRoute yana aiwatar da samfurin tsaro mai matakai da yawa:

```
Buƙata → CORS → Bututun Authz (rarrabawa → manufofi → tilastawa)
       → Matakan Kariya (mai ɓoye PII, kutsen umarni, gadar hangen nesa)
       → Mai Iyakance Buƙatu → Mai Katse Da'ira → Lokacin Jira → Kulle Samfuri → Mai Samarwa
```

### 🔐 Tantancewa da Ba da Izini

| Fasali                    | Aiwatarwa                                                                                                                                                            |
| ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Shigar Dashboard**      | Tantancewa ta kalmar sirri tare da token na JWT (kukis na HttpOnly)                                                                                                  |
| **Tantance API Key**      | Maɓallan da aka sa wa hannu da HMAC tare da tantance CRC                                                                                                             |
| **OAuth 2.0 + PKCE**      | OAuth na burauza/na'ura takamaimai ga mai samarwa yana amfani da PKCE inda ake tallafawa; ana sarrafa bayanan shaidar Devin na shigo da su kawai dabam.              |
| **Sabunta Token**         | Sabunta token na OAuth ta atomatik kafin ya ƙare                                                                                                                     |
| **Amintattun Kukis**      | `AUTH_COOKIE_SECURE=true` don muhallan HTTPS                                                                                                                         |
| **Bututun Authz**         | Rarraba hanyoyi (PUBLIC / CLIENT_API / MANAGEMENT) — duba `docs/architecture/AUTHZ_GUIDE.md`                                                                         |
| **Matakan Kariyar Hanya** | Samfuri mai matakai 3 don hanyoyin gudanarwa (LOCAL_ONLY / ALWAYS_PROTECTED / MANAGEMENT) — duba `docs/security/ROUTE_GUARD_TIERS.md`                                |
| **MCP na Manage-Scope**   | Ana kare damar `/api/mcp/*` ta nesa da API keys masu scope na `manage`; `/api/cli-tools/runtime/*` yana ci gaba da kasancewa strict-loopback. Duba ROUTE_GUARD_TIERS |
| **Scopes na MCP**         | Scopes 32 masu ƙayyadadden iko (read:health, write:combos, execute:completions, da sauransu) — duba `docs/frameworks/MCP-SERVER.md`                                  |

### 🛡️ Rufaffen Bayanan da Aka Adana

Ana rufe duk bayanai masu muhimmanci da aka adana a SQLite ta amfani da **AES-256-GCM** tare da samar da maɓalli ta scrypt:

- API keys, access tokens, refresh tokens, da ID tokens
- Tsari mai nau'i: `enc:v1:<iv>:<ciphertext>:<authTag>`
- Yanayin passthrough (plaintext) idan ba a saita `STORAGE_ENCRYPTION_KEY` ba

```bash
# Samar da maɓallin ɓoyewa:
STORAGE_ENCRYPTION_KEY=$(openssl rand -hex 32)
```

### 🛡️ Tsarin Matakan Kariya

OmniRoute yana zuwa da **rajistar matakan kariya** (`src/lib/guardrails/`) mai iya sake lodawa kai tsaye, tare da matakan kariya 3 da aka gina a ciki waɗanda aka tsara bisa fifiko:

| Matakin Kariya     | Fifiko | Manufa                                                                                                   |
| ------------------ | ------ | -------------------------------------------------------------------------------------------------------- |
| `vision-bridge`    | 5      | Yana haɗa samfuran da ba su da hangen nesa da bayanai masu fahimtar hoto; kariyar SSRF ga URLs na hotuna |
| `pii-masker`       | 10     | Ɓoye PII kafin+bayan kira (imel, waya, CPF, CNPJ, katunan kuɗi, SSN)                                     |
| `prompt-injection` | 20     | Yana gano tsarin sauya umarni/sace-rawa/jailbreak/ɓullar bayanai                                         |

Ana yi wa matakan kariya na musamman rajista ta `registerGuardrail(new MyGuardrail())`. Samfurin yana amfani da fail-open (kurakurai ba sa taɓa hana zirga-zirga). Ana iya ƙin amfani da su ga kowace buƙata ta hanyar header na `x-omniroute-disabled-guardrails`. → Duba [`docs/security/GUARDRAILS.md`](docs/security/GUARDRAILS.md).

### 🧠 Kariyar Kutsen Umarni

Middleware na heuristic mai yin iya ƙoƙarinsa wanda ke gano tsarin kutse cikin prompt a buƙatun LLM.
**Ba cikakken katangar tsaro ce ta kutse cikin prompt ba** — tana iya bayar da sakamakon ƙarya na tabbatarwa (persona mara illa/
prompt na RPG) da sakamakon ƙarya na rashin ganowa (leetspeak, tazara, tsare-tsaren da ba na Turanci ba).

| Nau'in Tsari           | Matsayin Haɗari | Misali                                                     |
| ---------------------- | --------------- | ---------------------------------------------------------- |
| Soke Umarnin Tsari     | Babba           | "yi watsi da duk umarnin da suka gabata"                   |
| Kwace Matsayi          | Matsakaici      | "yanzu kai ne DAN, za ka iya yin komai"                    |
| Kutse ta Mai Rabawa    | Babba           | Masu rabawa da aka sauya lamba don karya iyakokin mahallin |
| DAN/Jailbreak          | Matsakaici      | Sanannun tsare-tsaren prompt na jailbreak                  |
| Tonon Umarnin          | Babba           | "nuna min prompt ɗin tsarinka"                             |
| Kaucewa ta Sauya Lamba | Matsakaici      | warware base64/rot13/hex + muhimman kalmomin umarni        |

Ganowar da ke da matakin haɗari **Babba** kawai ake toshewa a yanayin `block`. Iyalai masu
matsakaicin haɗari ana rubuta su a log amma `sanitizeRequest` ba ya taɓa toshe su.

Saita ta dashboard (Settings → Security) ko `.env`:

```env
INPUT_SANITIZER_ENABLED=true
INPUT_SANITIZER_MODE=block    # warn | block (manufar kutse; tsohon "redact" ba ya cire rubutun kutse)
INPUT_SANITIZER_BLOCK_THRESHOLD=high  # high (na asali) | medium | low — ana toshe matakan haɗari da suka kai/zarce wannan a yanayin block
```

### 🔒 Ɓoye PII

Ganowa ta atomatik da kuma zaɓin ɓoye bayanan da za su iya bayyana mutum:

| Nau'in PII    | Tsari                 | Madadin            |
| ------------- | --------------------- | ------------------ |
| Imel          | `user@domain.com`     | `[EMAIL_REDACTED]` |
| CPF (Brazil)  | `123.456.789-00`      | `[CPF_REDACTED]`   |
| CNPJ (Brazil) | `12.345.678/0001-00`  | `[CNPJ_REDACTED]`  |
| Katin Kuɗi    | `4111-1111-1111-1111` | `[CC_REDACTED]`    |
| Waya          | `+55 11 99999-9999`   | `[PHONE_REDACTED]` |
| SSN (US)      | `123-45-6789`         | `[SSN_REDACTED]`   |

```env
PII_REDACTION_ENABLED=true   # buƙaci sake rubuta PII; ba ya dogara da INPUT_SANITIZER_MODE
PII_RESPONSE_SANITIZATION=true  # na zaɓi: ɓoye PII a amsoshin mai bayarwa da ake mayarwa ga abokan ciniki
```

### 🌐 Tsaron Cibiyar Sadarwa

| Fasali                     | Bayani                                                                                  |
| -------------------------- | --------------------------------------------------------------------------------------- |
| **CORS**                   | Bayyanannen jerin yarda na asalin giciye (`CORS_ALLOWED_ORIGINS`; tsohon `CORS_ORIGIN`) |
| **Tace IP**                | Jerin yarda/jerin toshewa na zangon IP a dashboard                                      |
| **Iyakance Yawan Buƙatu**  | Iyakokin yawan buƙatu na kowane mai bayarwa tare da jinkirtawa ta atomatik              |
| **Kariyar Cunkoson Gungu** | Mutex + kullewa ga kowace haɗi yana hana 502 masu yaɗuwa                                |
| **Sawun TLS**              | Kwaikwayon sawun TLS irin na burauza don rage gano bot                                  |
| **Sawun CLI**              | Jeren header/body na kowane mai bayarwa don dacewa da sa hannun CLI na asali            |

### 🔌 Juriya & Samuwar Sabis

| Fasali                    | Bayani                                                                        |
| ------------------------- | ----------------------------------------------------------------------------- |
| **Circuit Breaker**       | Yanayi 3 (Closed → Open → Half-Open) ga kowane mai bayarwa, adananne a SQLite |
| **Idempotency na Buƙata** | Tazarar daƙiƙa 5 don cire maimaitattun buƙatu                                 |
| **Exponential Backoff**   | Sake gwadawa ta atomatik tare da ƙara tsawon jinkiri                          |
| **Dashboard na Lafiya**   | Sa ido kan lafiyar mai bayarwa a ainihin lokaci                               |

### 📋 Bin Ƙa'idoji

| Fasali              | Bayani                                                                   |
| ------------------- | ------------------------------------------------------------------------ |
| **Riƙe Log**        | Sharewa ta atomatik bayan `CALL_LOG_RETENTION_DAYS`                      |
| **Ficewa daga Log** | Alamar `noLog` ga kowane API key tana kashe rubuta buƙatu a log          |
| **Log na Bincike**  | Ana bibiyar ayyukan gudanarwa a teburin `audit_log`                      |
| **Binciken MCP**    | Rubuta log na bincike mai amfani da SQLite don duk kiran kayan aikin MCP |
| **Tabbatarwar Zod** | Ana tabbatar da duk shigarwar API da tsarin Zod v4 lokacin loda module   |

---

## Sauye-sauyen Muhalli da Ake Buƙata

Dole ne a saita dukkan sirrika kafin fara uwar garken. Uwar garken za ta **dakatar nan take** idan babu su ko kuma ba su da ƙarfi.

```bash
# WAJIBI — uwar garken ba za ta fara ba idan babu waɗannan:
JWT_SECRET=$(openssl rand -base64 48)     # aƙalla haruffa 32
API_KEY_SECRET=$(openssl rand -hex 32)    # aƙalla haruffa 16

# ANA BA DA SHAWARA — yana ba da damar ɓoyewa yayin ajiya:
STORAGE_ENCRYPTION_KEY=$(openssl rand -hex 32)
```

Uwar garken tana ƙin sanannun ƙimomi marasa ƙarfi kamar `changeme`, `secret`, ko `password`.

---

## Tsaron Docker

- Yi amfani da mai amfani wanda ba root ba a yanayin samarwa
- Haɗa sirrika a matsayin volumes na karantawa kawai
- Kada a taɓa kwafe fayilolin `.env` cikin hotunan Docker
- Yi amfani da `.dockerignore` don ware fayiloli masu muhimmanci
- Saita `AUTH_COOKIE_SECURE=true` idan ana amfani da HTTPS

```bash
docker run -d \
  --name omniroute \
  --restart unless-stopped \
  --read-only \
  -p 20128:20128 \
  -v omniroute-data:/app/data \
  -e JWT_SECRET="$(openssl rand -base64 48)" \
  -e API_KEY_SECRET="$(openssl rand -hex 32)" \
  -e STORAGE_ENCRYPTION_KEY="$(openssl rand -hex 32)" \
  diegosouzapw/omniroute:latest
```

---

## Dogaro

- Gudanar da `npm audit` a kai a kai (`npm run audit:deps` yana duba babban ɓangare + electron)
- Ci gaba da sabunta abubuwan dogaro
- Aikin yana amfani da `husky` + `lint-staged` don binciken kafin commit (lint-staged + check-docs-sync + check:any-budget:t11)
- Bututun CI yana gudanar da ƙa’idojin tsaro na ESLint a kowane push (`no-eval`, `no-implied-eval`, `no-new-func` = kuskure)
- Ana tabbatar da constants na provider yayin loda module ta hanyar Zod (`src/shared/validation/schemas.ts`)
- Ana amfani da libraries masu tsaro tun daga asali: `dompurify` / `isomorphic-dompurify` (XSS), `jose` (JWT), `better-sqlite3` (babu haɗarin SQLi saboda parameterized queries), `bcryptjs` (hashing na kalmar sirri)

## Tsauraran Ƙa’idojin Tsaro

Kayan aiki da masu dubawa suna tilasta waɗannan ƙa’idoji:

1. **Kada a taɓa commit na sirrika** — git yana watsi da `.env`; `.env.example` shi ne samfuri (babu ƙimomin kai tsaye, comments kawai — duba PUBLIC_CREDS.md a ƙasa)
2. **Kada a taɓa amfani da `eval()`, `new Function()`, ko implied eval** — ESLint yana tilasta wannan
3. **Kada a taɓa tsallake hooks na Husky** (`--no-verify`, `--no-gpg-sign`) ba tare da bayyananniyar amincewar mai gudanarwa ba
4. **Kada a taɓa rubuta raw SQL a cikin routes** — koyaushe a bi ta `src/lib/db/` (parameterized)
5. **Koyaushe a tabbatar da inputs ta amfani da Zod** — `src/shared/validation/schemas.ts`
6. **Koyaushe a tsabtace upstream headers** — denylist yana cikin `src/shared/constants/upstreamHeaders.ts`
7. **A ɓoye credentials yayin ajiya** — AES-256-GCM ta hanyar `src/lib/db/encryption.ts`
8. **Public upstream OAuth identifiers ta hanyar `resolvePublicCred()`** — kada a taɓa saka ƙimomin `AIza…` / `GOCSPX-…` / `…apps.googleusercontent.com` kai tsaye a cikin source. Duba [`docs/security/PUBLIC_CREDS.md`](docs/security/PUBLIC_CREDS.md).
9. **Error responses ta hanyar `buildErrorBody()` / `sanitizeErrorMessage()`** — kada a taɓa saka raw `err.stack` / `err.message` a cikin HTTP / SSE / executor / MCP response bodies. Duba [`docs/security/ERROR_SANITIZATION.md`](docs/security/ERROR_SANITIZATION.md).
10. **Ƙimomin runtime na `exec()` / `spawn()` ta hanyar zaɓin `env`** — kada a taɓa amfani da string interpolation don saka external paths ko ƙimomin da ba a amince da su ba cikin scripts da ake miƙawa ga shell. Manazarta: `src/mitm/cert/install.ts::updateNssDatabases`.
11. **Fi son libraries masu tsaro tun daga asali** — duba [tldrsec/awesome-secure-defaults](https://github.com/tldrsec/awesome-secure-defaults) (Helmet.js, DOMPurify, ssrf-req-filter, safe-regex, Google Tink). Fara duba amfaninsu kafin ƙirƙirar naka.

## Sakamakon na’urar binciken sarkar samarwa (Socket.dev / Snyk / makamantansu)

> **Bayanin iyaka:** `socket.yml` da ke tushen ma’ajiyar yana tsara `projectIgnorePaths` ne kawai don binciken bayan wallafawa na Socket.dev a ɓangaren rajista kan kundin npm da aka wallafa — ba ƙa’idar CI/PR ce da ake tilasta wa yayin haɗa canje-canje ba. Babu wani workflow a `.github/workflows`, ko script na `package.json`, ko target na `Makefile` da ke kiran Socket.dev.

Kundin npm na `omniroute` da aka wallafa yana ƙunshe da build na Next.js mai `output: "standalone"`,
wanda ke nufin kowane mai sarrafa route — ciki har da fasalolin gata da aka
rubuta bayanansu (MITM, shigar da Zed, Cloud Sync, mai kula da sabis da aka haɗa ciki) — yana
ƙarewa a cikin minified chunks na `.next/server/*.js`. Na’urorin binciken sarkar samarwa
masu amfani da hasashe sukan daidaita waɗannan chunks da alamomin malware akai-akai.

Tsarin na’urar binciken da muke amfani da shi yana cikin [`socket.yml`](socket.yml) a
tushen repo (tsarin Socket.dev GitHub App v2 — duba
<https://docs.socket.dev/docs/socket-yml>). A sarari yana ware
kundin adireshi da ba a tura su (`tests/`, `_tasks/`, `_references/`, `_ideia/`,
`_mono_repo/`, `docs/`, da sauransu) domin na’urar binciken ta bayar da rahoto kawai kan hanyoyin code da
ke isa ga masu amfani da abin da aka wallafa — Socket
GitHub App ne ke gudanar da binciken ta hanyar karanta wannan fayil, ba workflow da ke cikin wannan ma’ajiya ba.

Ga kowane rukuni na sakamako, muna adana takardar tabbatarwa ta mai kula ga kowane sakamako:

- **[`docs/security/SOCKET_DEV_FINDINGS.md`](docs/security/SOCKET_DEV_FINDINGS.md)** —
  taswirar kowane sakamako: fayil ɗin tushe ↔ chunk da aka yi wa alama ↔ ɗabi’a ↔ matakin rage haɗari
  da aka aiwatar a v3.8.6.
- Tubalan `SECURITY-AUDITOR-NOTE:` da ke cikin tushe a wurin kowace function da aka yi wa alama
  suna komawa zuwa wannan takarda.

Ga masu amfani waɗanda pipeline ɗinsu ba zai iya sassauta faɗakarwar ba: yi build da
`OMNIROUTE_BUILD_PROFILE=minimal npm run build`. Wannan yana maye gurbin modules huɗu
masu muhimmanci da stubs waɗanda ke mayar da HTTP 503 `feature-disabled` a
lokacin aiki, don haka hanyoyin code masu gata ba sa kasancewa a cikin bundle ɗin a zahiri.
Duba [`docs/security/SOCKET_DEV_FINDINGS.md`](docs/security/SOCKET_DEV_FINDINGS.md)
don tsarin wallafawa.

## Manazarta

- [`docs/architecture/AUTHZ_GUIDE.md`](docs/architecture/AUTHZ_GUIDE.md) — pipeline na bayar da izini
- [`docs/security/GUARDRAILS.md`](docs/security/GUARDRAILS.md) — tsarin matakan kariya
- [`docs/security/COMPLIANCE.md`](docs/security/COMPLIANCE.md) — kundin binciken tantancewa da riƙe bayanai
- [`docs/security/PUBLIC_CREDS.md`](docs/security/PUBLIC_CREDS.md) — tsari na **tilas** don bayanan shaidar upstream na jama’a
- [`docs/security/ERROR_SANITIZATION.md`](docs/security/ERROR_SANITIZATION.md) — tsari na **tilas** don amsoshin kuskure
- [`docs/security/SOCKET_DEV_FINDINGS.md`](docs/security/SOCKET_DEV_FINDINGS.md) — takardar tabbatarwar mai kula ga sakamakon na’urar binciken sarkar samarwa
- [`docs/architecture/RESILIENCE_GUIDE.md`](docs/architecture/RESILIENCE_GUIDE.md) — circuit breaker + cooldown + lockout
- [`docs/security/STEALTH_GUIDE.md`](docs/security/STEALTH_GUIDE.md) — tantance sawun TLS (sanarwar doka/ɗabi’a)
- [`CLAUDE.md`](CLAUDE.md) — ƙa’idoji masu tsauri ga wakilan AI
- [tldrsec/awesome-secure-defaults](https://github.com/tldrsec/awesome-secure-defaults) — zaɓaɓɓun libraries masu tsaro ta tsoho