# Using Security Cards

> A concise guide for developers and AI agents using version-pinned secure-coding guidance.

Complete catalog: https://securitycards.rewarelabs.com/llms.txt
This guide: https://securitycards.rewarelabs.com/security-cards.md

## What Security Cards provides

Security Cards publishes secure defaults, implementation rules, and review checks for supported open-source libraries. Guidance is pinned to a library version so an agent can apply rules that match the code it is changing.

Each supported library version can provide:

- A **Security Blueprint** for its overall secure-by-default posture.
- A **library bundle** containing all available security categories.
- Individual **category cards** for narrow tasks such as authentication, injection, cryptography, or file handling.

## Recommended workflow

1. Inspect the project dependency manifest and identify the exact language, library, and version.
2. Find that library in the [complete catalog](https://securitycards.rewarelabs.com/llms.txt); do not invent URLs or assume support.
3. Read the Security Blueprint when adopting or reviewing a library for the first time.
4. Fetch the narrowest category card that covers the task. Use the library bundle when several categories apply.
5. Apply every relevant **Secure rule**, then run the card’s **Review checks** before completing the work.
6. Record the canonical card URLs in review notes or findings so another human or agent can verify the source.

## Choose the right scope

| Need | Fetch |
| --- | --- |
| Discover supported languages, libraries, and versions | `/llms.txt` |
| Discover one language | `/llms/{language}.txt` |
| Understand a library’s security posture | `/downloads/{language}/{library}/{version}/0_security_blueprint.md` |
| Apply every card for one library version | `/downloads/{language}/{library}/{version}.md` |
| Implement or review one security concern | `/downloads/{language}/{library}/{version}/{category}.md` |

Prefer: **single card → blueprint → library bundle → language bundle**. Fetch only the context the task needs.

## Three common AI workflows

### 1. Starting a project

- Choose supported library versions from the catalog.
- Read each selected library’s Security Blueprint before establishing architecture or defaults.
- Load the relevant library bundles and save persistent instructions in `AGENTS.md`, `CLAUDE.md`, or the equivalent tool configuration.
- Produce an implementation plan that names the rules and canonical sources it will follow.

### 2. Implementing a feature

- Confirm the installed dependency version from the project manifest.
- Fetch the narrowest card matching the feature’s security concern.
- Apply its Secure rules while writing code and use its Review checks before considering the feature complete.
- Return the canonical card URLs with the implementation summary.

### 3. Reviewing an existing codebase

- Inventory supported dependencies and their exact versions.
- Read the relevant blueprints, then fetch category cards matching the code paths under review.
- Compare the implementation against both Secure rules and Review checks.
- Report concrete findings with severity, affected code, remediation, and canonical Security Cards sources.

## Version handling

Canonical URLs use the version slug published in the catalog. If a known language and library is requested with a malformed or unsupported version, supported deployments redirect to that library’s latest supported version. Always verify the final redirected version before applying its guidance.

## Language indexes

- [C#](https://securitycards.rewarelabs.com/llms/c%23.txt)
- [Go](https://securitycards.rewarelabs.com/llms/go.txt)
- [Java](https://securitycards.rewarelabs.com/llms/java.txt)
- [JavaScript](https://securitycards.rewarelabs.com/llms/javascript.txt)
- [PHP](https://securitycards.rewarelabs.com/llms/php.txt)
- [Python](https://securitycards.rewarelabs.com/llms/python.txt)
- [Ruby](https://securitycards.rewarelabs.com/llms/ruby.txt)
- [Rust](https://securitycards.rewarelabs.com/llms/rust.txt)
- [Swift](https://securitycards.rewarelabs.com/llms/swift.txt)
- [TypeScript](https://securitycards.rewarelabs.com/llms/typescript.txt)

## Agent completion checklist

- The dependency version was read from the project, not guessed.
- The narrowest relevant Security Cards files were fetched.
- All applicable Secure rules were implemented.
- Review checks were run against the final code.
- Canonical source URLs were included in the result.