security-devsecops-ssdls-appsec — Cursor rule: setup and security
This rule guides Cursor on secure coding, dependencies, access control, and security checks. Use it when you want these requirements applied while editing project files.
.cursor/rules/security-devsecops-ssdls-appsec.mdcWhat security-devsecops-ssdls-appsec does
The rule applies at all times to matching Python, JavaScript, TypeScript, Go, Java, Ruby, PHP, C#, and shell files. It tells the agent to keep secrets out of source code and logs, validate user input, escape output, and avoid exec and eval. Database access should use parameterized queries or an ORM.
For dependencies, the rule calls for verified sources, vulnerability scans, and explicit approval before a new package is added. That approval requirement prevents the agent from introducing a library on its own. The guidance also covers secure authentication, password hashing, RBAC, and least privilege.
It describes CI/CD checks including SAST, SCA, secret scanning, infrastructure scanning, and DAST. It also asks for security controls to be documented and references OWASP Top 10, NIST, and ISO 27001.
What it helps with
- keep secrets out of source code and logs
- validate input and build database queries safely
- restrict API and operation access by role
- check dependencies and code for known vulnerabilities
- document security controls for audits
Example prompts for the agent
- Check this code for exposed secrets and unsafe handling of user input.
- Before adding a package, check whether it has approval and known vulnerabilities.
- Suggest security checks for this project's CI/CD pipeline.
How to install security-devsecops-ssdls-appsec
Manually: put the files in place
.cursor/rules/security-devsecops-ssdls-appsec.mdcFrontmatter: description, globs, alwaysApply
Manually: put the files in place
.claude/rules/security-devsecops-ssdls-appsec.mdThe paths frontmatter field limits the files: move globs from the source into paths
AGENTS.md
Codex reads AGENTS.md: paste the rule text there
Manually: put the files in place
.github/instructions/security-devsecops-ssdls-appsec.instructions.mdThe applyTo field sets which files it applies to: move globs from the source into applyTo
Manually: put the files in place
.devin/rules/security-devsecops-ssdls-appsec.mdManually: put the files in place
.clinerules/security-devsecops-ssdls-appsec.mdStep by step, with commands for each platform: Cursor rules: .mdc files, four modes and what replaced .cursorrules
Questions about security-devsecops-ssdls-appsec
How do I install security-devsecops-ssdls-appsec in Cursor?
Add the rule file to your project at .cursor/rules/security-devsecops-ssdls-appsec.mdc.
What does security-devsecops-ssdls-appsec do?
It sets guidance for secure coding, secrets, database access, dependencies, authentication, and authorization. It also describes security checks and documentation practices.
Which files does the rule cover?
Its patterns match Python, JavaScript, TypeScript, Go, Java, Ruby, PHP, C#, and shell files. The rule is configured to apply at all times.
Source text
security-devsecops-ssdls-appsec.mdc · CC0-1.0
--- description: "Cursor rules for secure coding, secret handling, dependency hygiene, authentication, authorization, security testing, and compliance documentation." globs: ["**/*.py", "**/*.js", "**/*.ts", "**/*.go", "**/*.java", "**/*.rb", "**/*.php", "**/*.cs", "**/*.sh"] alwaysApply: true --- # DevSecOps + SSDLC + AppSec Cursor Rule ## General Security Principles - Never hardcode secrets, credentials, or API keys. Use environment variables or secure vaults for sensitive data. - Prohibit the inclusion of `.env`, secret config files, or unknown tokens in source control. - Never log sensitive data, secrets, or session tokens in application logs. - Validate and sanitize all user input. Escape output in HTML, JS, and SQL contexts. - Avoid unsafe functions such as `exec`, `eval`, or similar dynamic code execution. ## Database Security - Use parameterized queries or ORM for all database access. Do not use string concatenation for query building. - Ensure database users have the least privilege required for their tasks. - Regularly review and update database access policies. ## Dependency Management - Only use packages from verified sources. - Do not add new dependencies without explicit approval and security review. - Regularly update dependencies and scan for known vulnerabilities (SCA). ## Authentication & Authorization - Use secure authentication frameworks; never implement custom authentication. - Store passwords using strong, salted hashes (e.g., Argon2, bcrypt). - Implement Role-Based Access Control (RBAC) for sensitive operations. - Enforce the principle of least privilege for APIs and UI actions. ## Secure SDLC Practices - Integrate Static Application Security Testing (SAST) and Software Composition Analysis (SCA) into the CI pipeline. - Scan all code for secrets before merging (Secret Scanning). - Use Infrastructure as Code (IaC) scanning for all infrastructure code. - Integrate Dynamic Application Security Testing (DAST) in the CD pipeline for deployed applications. - Enforce Policy as Code (PaC) for automated, version-controlled security policies. ## Monitoring & Feedback - Enable continuous vulnerability monitoring and alerting. - Integrate Runtime Application Self-Protection (RASP) and Web Application Firewall (WAF) as appropriate. - Encourage regular vulnerability assessments and penetration testing. - Maintain a feedback loop to update rules and prompts based on recurring vulnerabilities. ## Compliance & Documentation - Align with industry standards (e.g., OWASP Top 10, NIST, ISO 27001). - Document all security controls and decisions for auditability.
© PatrickJS · CC0-1.0 · PatrickJS/awesome-cursorrules
