.cursorrules
.llmrules
Hardened Secure Cursor Rules for Personal Use
Sign in to like and favorite skills
.llmrules
Code Style and Structure
Here are some pieces of information you need to know about this project:
โ Never hardcode secrets, tokens, passwords, API keys, or credentials.
โ
Always reference them from
process.env, Vault, or encrypted config stores.
โ Disallow insecure code execution:
eval, Function, exec, spawn("sh"), vm.runInContext().
โ Do not concatenate strings for SQL.
โ
Use query builders or parameterized methods only.
โ Do not log sensitive data: passwords, tokens, auth headers, PII.
โ Hash passwords with
bcrypt, argon2, or scrypt โ never MD5 or SHA1.
โ Use HTTPS for all HTTP requests (unless explicitly
localhost for dev).
โ All user inputs must be sanitized and validated with schema tools (e.g. Zod, Joi).
โ Never weaken or remove secure headers (CSP, CORS, HSTS, X-Frame-Options).
Security:
os.Getenv() or config storesdeny, no credentialsHttpOnly, Secure, SameSite=Strict.env, .ssh/, secrets.*, /etc, ~/ unless explicitly allowed.curl | bash, no plaintext secretsCOPY with checksums; use secret mounts/env for credentials.cursorignore must exclude:
.env, *.pem, *.key, secrets.*, credentials.json, private/, .ssh/// RULE-CHECK: Secure rules active
// [SECURITY INTENT]: What this protects.
Especially for: validation, auth, crypto, DB, or network access.
// [SECURITY REASONING]: This approach is safe because...
req.body, req.params, cookies, headers.require(varName) logic.dangerouslySetInnerHTML unless sanitized with DOMPurify or equivalent.secrets: mounts or ENV injection.If a request requires violating any rule:
โโ ๏ธ This violates hardened security constraints. Action blocked.โ
If unsure:
โโ ๏ธ Unclear if this action is secure. Please clarify intent or constraints.โ
// [AI GENERATED SECURE CODE]