Free tool · Security.md
Security rules your coding agent follows.
Pick what you are building and the agent you use. Veriom writes the rule file it reads, from reviewed security skills and, in your workspace, your own architecture map. No model call, no units.
- Claude Code skill
.claude/skills/<name>/SKILL.md - Cursor rules
.cursor/rules/<name>.mdc - Codex
AGENTS.md - GitHub Copilot
.github/copilot-instructions.md - Windsurf rules
.windsurf/rules/<name>.md - Plain file
SECURITY.md
How it works
Three choices, one file for your repository.
The tool lives in your Veriom workspace, beside the skill catalog. Build a file, copy it or download it, and commit it with your code.
Choose what you are building
Web app, API, Mobile backend, IaC and cloud, AI agent or LLM app, Data pipeline, CI/CD. Each brings its own rules and the review checks behind them.
Choose your coding agent
The file comes in the format and at the path that agent reads, with the frontmatter it expects.
Add your constraints
Your stack adds framework rules. Compliance needs add evidence rules. Risk appetite sets when the agent stops to ask.
What goes into it
Rules with a review method behind them.
A rule file is only as good as the judgement in it. Each file carries the checks that tell a real risk from a missing best practice.
Reviewed skills, not a prompt
The rules come from the same reviewed security skills Veriom's own reviews apply, each written to separate a real risk from a checklist item.
Your architecture, when you want it
In your workspace the file can name your trust boundaries, data stores and services from Veriom's map. Names only, and anything that looks like a secret is left out.
Deterministic and free
No model writes the file, so it uses no units and the same choices give the same file. Copy it or download it straight into your repository.
Refine on your own keys
Optional: your own model adds rules for your codebase to the file, each citing your workspace's evidence. It runs only on your workspace's own model keys, never on Veriom's.
Sample
An API on FastAPI and PostgreSQL.
An excerpt of a generated Claude Code skill. The full file adds the compliance rules, review checks and guardrails.
--- name: api-security description: "Security rules for API code in this repository. Use when writing, reviewing or changing code, configuration or pipelines here." --- # Security rules: API ## How to work Risk appetite: moderate. - Explain in the change description any change that touches authentication, authorization, secrets or tenant data. - Fix rule violations in code you change, and point out the ones you notice elsewhere. ## API rules - Require authentication on every route by default; an unauthenticated route is a reviewed exception. - Authorize each object a request names, checking that the caller may act on that exact identifier. - Validate request bodies against schemas that reject unknown fields, so a client cannot set server-owned fields such as role, owner or price. ## Stack Stack: FastAPI, PostgreSQL. - Declare request bodies as models that forbid extra fields, and enforce authorization in a dependency on every route. - Use parameterized queries, and enforce tenant isolation with row-level security or a mandatory tenant filter.
Questions
Before you commit the file.
Is Security.md really free?
Yes. Building a file uses no units of your plan, because no model is called. Only the optional Refine with AI step runs a model, on your workspace's own model keys, and it can only add rules: every rule the file already has stays.
Which coding agents does it support?
Claude Code skill, Cursor rules, Codex, GitHub Copilot, Windsurf rules, Plain file. Windsurf files are shortened to fit Windsurf's size limit, starting with the least important checks.
What does it know about my system?
In your workspace it adds, by default, the names of your trust boundaries, data stores and services from your Veriom architecture map, and the connections that cross a boundary. Turn that off before you build to get a file without them. It never copies code or secrets.
Does it claim my code is compliant?
No. Compliance choices add rules about keeping evidence, and the file tells your agent never to state that the code is compliant or certified.
Give your coding agent the rules before it writes the code.
Security.md is in every Veriom workspace, under Skills: build the file, then commit it with your code.