mirror of
https://github.com/matank001/cursor-security-rules.git
synced 2025-12-12 20:35:42 +01:00
38 lines
1.8 KiB
Plaintext
38 lines
1.8 KiB
Plaintext
---
|
|
description:
|
|
globs:
|
|
alwaysApply: true
|
|
---
|
|
# Secure Development Principles
|
|
|
|
These rules define essential practices for writing and generating secure code.
|
|
They apply universally — to manual development, automated tooling, and AI-generated code.
|
|
|
|
All violations must include a clear explanation of which rule was triggered and why, to help developers understand and fix the issue effectively.
|
|
|
|
## 1. Do Not Use Raw User Input in Sensitive Operations
|
|
- **Rule:** Untrusted input must never be used directly in file access, command execution, database queries, or similar sensitive operations.
|
|
|
|
## 2. Do Not Expose Secrets in Public Code
|
|
- **Rule:** Secrets such as API keys, credentials, private keys, or tokens must not appear in frontend code, public repositories, or client-distributed files.
|
|
|
|
## 3. Enforce Secure Communication Protocols
|
|
- **Rule:** Only secure protocols (e.g., HTTPS, TLS) must be used for all external communications.
|
|
|
|
## 4. Avoid Executing Dynamic Code
|
|
- **Rule:** Dynamically constructed code or expressions must not be executed at runtime.
|
|
|
|
## 5. Validate All External Input
|
|
- **Rule:** Inputs from users, external APIs, or third-party systems must be validated before use.
|
|
|
|
## 6. Do Not Log Sensitive Information
|
|
- **Rule:** Logs must not contain credentials, tokens, personal identifiers, or other sensitive data.
|
|
|
|
## 7. Prevent Disabling of Security Controls
|
|
- **Rule:** Security checks must not be disabled, bypassed, or suppressed without documented and reviewed justification.
|
|
|
|
## 8. Limit Trust in Client-Side Logic
|
|
- **Rule:** Critical logic related to permissions, authentication, or validation must not rely solely on client-side code.
|
|
|
|
## 9. Detect and Eliminate Hardcoded Credentials
|
|
- **Rule:** Credentials must not be hardcoded in source files, configuration, or scripts. |