Security Rules Files for AI Code Editors: The Definitive .cursorrules Security Template

# Security Rules for AI Code Generation
# Copy to: .cursorrules, .windsurfrules, or .github/copilot-instructions.md

## Authentication & Authorization
- Every API endpoint MUST include authentication middleware unless explicitly marked as public
- Always verify the authenticated user owns the resource they are requesting (authorization != authentication)
- Use bcrypt or argon2 for password hashing, never MD5 or SHA-256 alone
- Session tokens must be cryptographically random, minimum 256 bits
- Set httpOnly, secure, and sameSite flags on all authentication cookies
- Implement rate limiting on login, registration, and password reset endpoints (max 5 attempts per 15 minutes)

## Input Validation
- Validate ALL user input on the server side, even if client validation exists
- Use allowlists over denylists for input validation
- Sanitize user input before rendering in HTML to prevent XSS
- Validate file uploads: check MIME type, enforce size limits, sanitize filenames
- Reject unexpected fields in request bodies (use strict schema validation)

## Database Security
- ALWAYS use parameterized queries or prepared statements, never string concatenation
- Apply the principle of least privilege to database user permissions
- Never expose raw database errors to clients
- Use an ORM's built-in query builder instead of raw SQL when possible
- Implement row-level security or ownership checks in queries (WHERE user_id = $1)

## Secrets Management
- NEVER hardcode API keys, tokens, passwords, or connection strings in source code
- Load all secrets from environment variables
- Add .env, .env.*, *.pem, *.key to .gitignore
- Validate that required environment variables exist at application startup

## Error Handling
- Return generic error messages to clients (e.g., "Something went wrong")
- Log detailed errors server-side with request context for debugging
- Never expose stack traces, file paths, or internal state in API responses
- Use consistent error response format across all endpoints

## HTTP Security
- Set Content-Security-Policy, X-Content-Type-Options, X-Frame-Options headers
- Configure CORS with specific allowed origins, never use wildcard (*) in production
- Enforce HTTPS for all endpoints
- Set appropriate Cache-Control headers for sensitive responses (no-store)

## Dependencies
- Do not suggest deprecated or unmaintained packages
- Prefer well-maintained packages with active security advisories
- Pin dependency versions in production lockfiles

// AI-generated endpoint: works fine, completely unprotected
app.get('/api/invoices/:id', async (req, res) => {
  const invoice = await Invoice.findById(req.params.id);
  res.json(invoice);
});

// Same prompt, but with security rules active
app.get('/api/invoices/:id', authenticate, async (req, res) => {
  const invoice = await Invoice.findOne({
    _id: req.params.id,
    userId: req.user.id  // ownership check
  });

  if (!invoice) {
    return res.status(404).json({ error: 'Invoice not found' });
  }

  res.json(invoice);
});

import { z } from 'zod';

const CreateUserSchema = z.object({
  email: z.string().email().max(255),
  name: z.string().min(1).max(100).trim(),
  role: z.enum(['user', 'editor']),  // allowlist, not free text
});

app.post('/api/users', authenticate, async (req, res) => {
  const result = CreateUserSchema.safeParse(req.body);

  if (!result.success) {
    return res.status(400).json({
      error: 'Invalid input',
      details: result.error.flatten(),
    });
  }

  const user = await createUser(result.data);
  res.status(201).json(user);
});

# AI-generated config file
STRIPE_KEY = "sk_live_abc123..."
DATABASE_URL = "postgresql://admin:password@prod-db:5432/myapp"

import os

STRIPE_KEY = os.environ["STRIPE_SECRET_KEY"]
DATABASE_URL = os.environ["DATABASE_URL"]

# Validate at startup
required_vars = ["STRIPE_SECRET_KEY", "DATABASE_URL", "SESSION_SECRET"]
missing = [v for v in required_vars if v not in os.environ]
if missing:
    raise RuntimeError(f"Missing environment variables: {', '.join(missing)}")

## Next.js Specific
- Use Server Actions or API Routes for data mutations, never expose database calls in client components
- Validate all Server Action inputs with zod before processing
- Use next/headers for reading cookies, never parse them manually
- Apply middleware.ts for route-level authentication checks
- Never pass sensitive data through searchParams or client-side state
- Use Content-Security-Policy headers via next.config.js security headers

## Python Specific
- Use Pydantic models for all request/response validation (FastAPI)
- Use Django Forms or DRF Serializers for input validation (Django)
- Apply @login_required or Depends(get_current_user) to all protected views
- Use Django ORM or SQLAlchemy ORM instead of raw SQL
- Set SECURE_BROWSER_XSS_FILTER, SECURE_CONTENT_TYPE_NOSNIFF in Django settings
- Never use pickle for deserializing untrusted data

## Supabase/Firebase Specific
- ALWAYS define Row Level Security (RLS) policies before creating tables
- Never disable RLS for convenience during development
- Use service_role key ONLY in server-side code, never in client bundles
- Validate that storage bucket policies restrict file access by user
- Test RLS policies with different user contexts before deployment

# In your Makefile or as a package.json script
sync-rules:
    cp .cursorrules .windsurfrules
    mkdir -p .github
    cp .cursorrules .github/copilot-instructions.md