compliance-awareness

对生成代码进行 OWASP/CWE/SANS 控件映射与可追溯标注。

帮你把自动生成的代码对齐到 OWASP、CWE、SANS 等安全控件上，给处理敏感数据的函数打上 PII/PHI/PCI 分类注释并标注对应漏洞类别。通常在代码生成、安全审计或合规追溯场景用到，能让审计员快速看到谁改了哪段会影响合规。特别之处是把安全分类和审计日志（谁、什么、何时）直接嵌进代码注释和映射里，方便追溯而不泄露敏感内容。

# Compliance Awareness

## Rules (for AI agents)

### ALWAYS
- Tag functions that handle PII / PHI / PCI data with a comment indicating the
  classification (e.g. `// classification: PII`).
- Log audit events for security-relevant actions (login, permission change, data
  export, admin operations) — log who, what, when, NOT the sensitive payload.
- Identify the CWE / OWASP category for security-relevant code in comments when the
  team's convention is to include traceability (`// addresses CWE-79 — XSS`).
- For PCI scope, segregate card-data-handling code into clearly-named modules so
  scope boundaries are visible.
- For HIPAA workloads, prefer encryption at rest AND in transit, with docume