Security-Focused Project Rules

securitycompliance

Security practices and compliance guidelines for projects handling sensitive data, covering OWASP Top 10, secrets management, and secure coding patterns.

Целевые файлы

Файл	Формат
.cursorrules	plaintext
CLAUDE.md	markdown
.github/copilot-instructions.md	markdown

Содержимое

Never hardcode secrets, API keys, passwords, or tokens in source code. Use environment variables or a secrets manager (e.g., Vault, AWS Secrets Manager). Validate and sanitize all user input on the server side. Client-side validation is for UX only — never trust it for security. Use parameterized queries or ORM methods for all database operations. Never concatenate user input into SQL strings. Implement proper authentication and authorization checks on every endpoint. Use middleware or guards — never rely on client-side route protection alone. Set secure HTTP headers: Content-Security-Policy, X-Content-Type-Options, Strict-Transport-Security, X-Frame-Options. Log security-relevant events (login attempts, permission denials, input validation failures) but never log sensitive data like passwords or tokens. Dependencies: run `npm audit` / `pip audit` regularly. Pin dependency versions. Review changelogs before major upgrades. Follow the principle of least privilege: grant minimum required permissions for database roles, API scopes, and file system access. Encrypt sensitive data at rest and in transit. Use TLS 1.2+ for all network communication. Hash passwords with bcrypt or argon2. Conduct threat modeling for new features. Consider OWASP Top 10 risks: injection, broken auth, sensitive data exposure, XXE, broken access control.

CLI

npx mindaxis apply security-rules --target cursor --scope project

Используется в паках

AI App Builder

Build AI applications