Stop keeping security rules in the prompt: a deterministic check engine for code from AI assistants

A security rule in a prompt depends on the assistant remembering it. I wanted the rule in code that gives the same answer every time, so I built Secure & Private by Design. Version 0.2.0 is out under Apache-2.0.

The engine is called sbd. It runs as a CLI, as pre-commit hooks, as a GitHub Action and as an MCP server, and all four share one rule set. An assistant can explain a finding and propose a fix. It does not decide what the findings are.

What it finds

This is sbd check on the sample app in mcp-server/test/fixtures/clinic-app, trimmed. I ran it on v0.2.1.

Manifest: privacy-security-manifest.yaml (schemaVersion 0.2)
Regimes:  nist-ssdf-1.1, iso-27001-2022, dpdp-2023

  1. [CRITICAL] SBD-SCAF-001 Missing src/privacy/consent. (Consent scaffold).
 10. [HIGH] SBD-FIELD-001 prisma/schema.prisma:5 — Field dateOfBirth looks personal or sensitive but no dataCategory lists it.
 12. [HIGH] SBD-CODE-002 src/routes/patients.ts:19 — Log call references a field the manifest classifies as personal or sensitive.
       console.log('loaded patient', patient.email);
       → Route the value through the redacting logger in src/security/audit_log.
 13. [HIGH] SBD-CODE-003 src/services/triage.ts:6 — Model inference call with no decision-log call within 15 lines.
 16. [MEDIUM] SBD-CODE-001 src/routes/patients.ts:12 — Handler mutates data without an auditLog() call within 40 lines.

17 finding(s): 2 critical, 11 high, 3 medium, 1 low, 0 info.
This report lists control gaps. It is not a compliance determination.

Each finding has a stable rule ID, a severity, a location and the regime controls it maps to. Output comes as text, JSON or SARIF 2.1.0. Exit code 0 means nothing at or above --fail-on (default high), 1 means findings, and 2 means a usage or runtime error.

Secrets and personal data

sbd scan needs no manifest. I gave it four fake values on stdin:

  1. [CRITICAL] SBD-SECRET-001 :1 — Hardcoded AWS access key ID.
       const k = "AKIA****************";
  2. [HIGH] SBD-PII-002 :2 — Value matches the PAN format. Personal data does not belong in the repository.
       const pan = "**********";
  3. [HIGH] SBD-PII-003 :3 — Value looks like an Indian mobile number. Personal data does not belong in the repository.
       const phone = "**********";
  4. [HIGH] SBD-PII-004 :4 — Value looks like a person's email address. Personal data does not belong in the repository.
       const mail = "********************";

The report masks each value. Aadhaar numbers are matched with their checksum. Placeholder values such as @example.com addresses are skipped.

Rules are patterns over your code and data files, so a clean report does not prove the data is absent.

Try it

The engine ships as prebuilt bundles and needs only Node.js 20+. It is not on the npm registry yet.

git clone --branch v0.2.1 https://github.com/ankush1982/ai-secure-by-design
cd /path/to/your/repo
node /path/to/ai-secure-by-design/dist/sbd.mjs check

To set up a project, pick your regimes:

sbd init --non-interactive --regime nist-ssdf-1.1,iso-27001-2022
sbd validate
sbd deploy --dry-run
sbd deploy

init writes a draft privacy-security-manifest.yaml. It leaves dataCategories empty and lists personal-looking fields as TODO(user): comments, because classification is your call. deploy copies the scaffolds the manifest requires and leaves files you have edited alone unless you pass --force.

For commits, add the hooks through pre-commit:

repos:
  - repo: https://github.com/ankush1982/ai-secure-by-design
    rev: v0.2.1
    hooks:
      - id: sbd-secrets
      - id: sbd-check
      - id: sbd-provenance

git commit --no-verify turns local blocking off, so make the GitHub Action a required check. The workflow template is templates/.github/workflows/secure-by-design.yml. It uploads SARIF to code scanning and fails the build on findings at or above fail-on.

What lands in your repo

sbd deploy adds scaffolds as ordinary code you can edit or delete: consent, data rights, retention, breach notification, a children's data gate, RBAC, audit logging, security headers, PHI redaction, AI decision logs and a human oversight gate. TypeScript + Express and Python + FastAPI are covered. Next.js is planned.

One YAML manifest records your data categories, regimes, retention and consent. Only the regimes you list are enforced: NIST SSDF 1.1, ISO 27001:2022 Annex A controls for the dev and SDLC slice, and India's DPDP Act 2023.

AI-specific checks

Add ai-security-wiki to your regimes to turn on checks from the AI Security Wiki, which I co-author with Nachiket Sathaye. That adds rules for model output reaching eval, a shell, HTML or SQL; unsafe model loading; trust_remote_code; unpinned models and MCP servers; remote MCP over HTTP; auto-approved tools; and agents run with approvals off.

sbd evidence then plans audit evidence for the wiki's 46 AI controls, showing each as gap, checked or manual. checked only means the automated checks found nothing, so it does not show a control works.

What it does not do

• It is not a compliance certification, legal advice or a substitute for a Data Protection Officer or counsel.
• It does not detect names, postal addresses, clinical free text in code, or personal data in production databases or logs.
• The DPDP scaffolds have not had a legal review.
• The repo's tests cover the CLI, git hooks, GitHub Action and MCP server.
• The fallback hook scripts for machines without Node.js cover secrets only.

Everything runs locally, with no telemetry and no hosted service. The v0.2.1 release notes cover upgrades and known limits, and the roadmap lists what comes next. If it's useful, please star the repo.