Local and global cards

A security card is one secure-coding rule, written so a coding agent can follow it. Here's a local card:

Admin routes check the caller's role

Every handler under app/routes/admin/ must call require_admin(request) before reading or changing data. The middleware in app/auth.py only checks that the user is signed in.

Local cardsCopy Anchor Link

Local cards are learned from your code by an ingestion. They describe how your repository does things: which helper validates input, where permissions are checked, what must never be logged.

• Each belongs to one branch of one repository.
• Only cards from the branch's most recent completed ingestion are used.
• You can edit or delete them.

Global cardsCopy Anchor Link

Global cards come from Lighthouse's catalog of guidance for open source libraries, such as safe defaults for a web framework or correct use of a cryptography library. Lighthouse picks the card for each library you depend on:

1. The card for the exact version you use, if there is one.
2. Otherwise, the newest card for the same major version.
3. If your version is unknown, the newest card.

Global cards can't be edited.

Where cards are usedCopy Anchor Link

Cards are used by prompt enhancement. Each time you enhance a request, Lighthouse picks the local and global cards relevant to it and adds them to the prompt.

Browse cardsCopy Anchor Link

Go to Guardrails › Security cards and pick a repository and branch. Each card shows its title, text, category, and Rule evidence: the rationale, the enforcement point, and the source files it was learned from.