<!-- Generated from models/_canonical by scripts/build-model-variants.js. Edit the canonical source, not this file. Behavioural profile for Claude: scripts/model-profiles.json -->

<critical_constraints> FORBIDDEN: Truncating code or writing placeholders such as "// ... existing code ..." or "# rest unchanged". Every edit is complete and applies as written. FORBIDDEN: Reporting a check as passed without showing the command and its output. REQUIRED: Reason through the rules below before the first edit; when two rules conflict, the one stated first wins.

• Never enable compression (CRIME) or renegotiation initiated by the client. </critical_constraints>

---

#Purpose

Rules for transport security. Encryption of stored data is Security/encryption; the response headers that accompany TLS are Security/headers.

HTTPS is not optional for any endpoint. Not for static pages, not for health checks, not for internal services. Plaintext anywhere permits downgrade, injection of content, and theft of any credential that traverses it.

---

#Protocol versions

<security_rules>

nginx
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;          # correct for TLS 1.3
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305;

ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;                # tickets can undermine forward secrecy

ssl_stapling on;                        # OCSP stapling
ssl_stapling_verify on;

Require ECDHE key exchange so every session has forward secrecy — recording traffic today must not become readable if the private key leaks later. Static RSA key exchange does not provide this and is absent from TLS 1.3 for that reason.

Never enable compression (CRIME) or renegotiation initiated by the client.

---

</security_rules>

#Certificates

<security_rules>

• Automate issuance and renewal with ACME (certbot, lego, caddy, or your platform's manager). Manual renewal is how outages happen — the certificate expires on a weekend and nobody is paged until users are.
• Alert at 30 days before expiry, independently of the renewal automation. The alert exists to catch the automation failing.
• Prefer ECDSA P-256 — smaller and faster than RSA-2048 — and serve an RSA chain alongside only if you must support very old clients.
• Serve the full chain, not just the leaf. A missing intermediate works in browsers that cache it and fails in curl, mobile apps and server-to-server calls — an intermittent failure that is painful to diagnose.
• Keep private keys at 0600, owned by the service user, never in the repository.
• Add a CAA record so only your chosen authority may issue for the domain.

---

</security_rules>

#HSTS

<security_rules>

ini
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

• Send it only over HTTPS. Browsers ignore it on plaintext responses.
• Start with a short max-age, confirm nothing breaks, then raise to a year.
• preload is effectively irreversible on a useful timescale. Every present and future subdomain must serve HTTPS before you submit. → Security/headers

---

</security_rules>

#Redirects and mixed content

<security_rules>

• Redirect HTTP to HTTPS with 301, and redirect to the same path. Sending every plaintext request to / loses the user's destination.
• The redirect is a fallback, not the control — the first plaintext request is already interceptable. HSTS is what removes it for return visitors.
• Serve every subresource over HTTPS. One http:// script tag blocks on mixed content; one http:// image degrades the lock icon and leaks the URL.
• Set cookies Secure so they are never transmitted in plaintext.

---

</security_rules>

#Internal traffic

<security_rules>

Terminating TLS at a load balancer and speaking plaintext behind it is only acceptable when that internal network is genuinely trusted — and in a shared cloud VPC it usually is not.

• Prefer mutual TLS between services, or a service mesh that provides it.
• Verify certificates on internal calls too. Disabling verification "because it is internal" is how a compromised pod reads everything.
• Never set NODE_TLS_REJECT_UNAUTHORIZED=0 or rejectUnauthorized: false. That disables verification globally and turns TLS into obfuscation.

js
// If a private CA is the reason for the temptation, trust the CA — do not
// disable verification.
const agent = new https.Agent({ ca: fs.readFileSync("/etc/ssl/internal-ca.pem") });

---

</security_rules>

#Verifying

<security_rules>

bash
# Protocol, cipher, chain and expiry from the live endpoint
openssl s_client -connect app.example.com:443 -servername app.example.com < /dev/null

# Confirm weak protocols are actually refused
openssl s_client -tls1_1 -connect app.example.com:443 < /dev/null   # expect failure

Test the deployed origin, not the configuration file. Then run an external scan (SSL Labs, testssl.sh) and re-run it after any proxy or platform change.

---

</security_rules>

#Anti-patterns

---

#Checklist

• Only TLS 1.2 and 1.3 are enabled; older protocols refused and verified refused
• Cipher suites are AEAD with ECDHE key exchange
• TLS compression and client-initiated renegotiation are disabled
• Certificates renew automatically, with an independent 30-day expiry alert
• The full chain is served and verified with openssl s_client
• Private keys are 0600 and never committed
• A CAA record restricts which authority may issue
• HSTS is sent over HTTPS only, with includeSubDomains
• preload used only after auditing every subdomain
• HTTP redirects 301 to the same path over HTTPS
• No mixed content; all cookies are Secure
• Internal service traffic uses mTLS or verified TLS, never disabled verification