Skip to content
vibespell

.cursor/rules/security.mdc

Cursor security rule for Astro

A focused Cursor `.mdc` rule for auth, secrets, and untrusted input. It attaches when those files change, instead of repeating security policy in every chat. This copy is written for a Astro project. This repository is an Astro site. Pages ship zero client JavaScript unless an island needs it. Content lives in content collections when the repo already uses them.

The example uses a balanced, readable style, pragmatic tests, and comments only where the intent is not obvious. Open the generator to make the agent stricter, switch to test-first, quiet the comments, or pick a different file.

The example assumes Astro. It does not assume React, Vue, or a particular UI framework for islands. Use the integration already in astro.config.

Customize in the generatorBrowse the library

Example file

Balanced strictness, readable style, pragmatic tests. Download name: security.mdc

---
description: "Security rules for a Astro repository"
globs: "**/*{auth,Auth,secret,config,Config}*"
alwaysApply: false
---

# Security rules

Attach these rules when editing auth, config, or secret-handling code in this Astro repository.
This repository is an Astro site. Pages ship zero client JavaScript unless an island needs it. Content lives in content collections when the repo already uses them.

## Secrets and trust

- Do not put secrets in client islands or public env vars.
- Sanitize content that is rendered as HTML.
- Validate request bodies in endpoints before using them.

## Errors

- Fail at the boundary. Do not swallow errors.
- Return a 404 via `Astro.redirect` or the response status the project uses when content is missing. Do not render an empty shell.

## Done when

- Untrusted input is validated before a side effect.
- No secret was added to source, logs, or a client bundle.
- `npm run build` succeeds for the routes you touched.

Add it to the project

  1. 01

    Copy a starting file

    Copy the example Cursor security rule on this page, or open the generator if you want different testing, strictness, or comment rules.

  2. 02

    Save it at .cursor/rules/security.mdc

    Save it at `.cursor/rules/security.mdc` in the Astro repo. Narrow the globs if your auth and config files live in a known folder.

  3. 03

    Start a fresh agent session

    Rules files are read when a session starts. A chat that is already open may still be using the old instructions.

  4. 04

    Give it one small task

    Ask for one change a Astro agent often gets wrong, such as a page that renders content on the server instead of fetching it in a client island. If it ignores the file, confirm the path and start a new session.

Questions about this file

Where do I put Cursor security rule in a Astro repo?

Save it at `.cursor/rules/security.mdc` in the Astro repo. Narrow the globs if your auth and config files live in a known folder.

Which tools read this Cursor security rule?

Cursor loads `.cursor/rules/security.mdc` for files that match its globs. Pair it with the always-on project rule. It is not a substitute for code review.

What does the Astro example assume?

The example assumes Astro. It does not assume React, Vue, or a particular UI framework for islands. Use the integration already in astro.config.

Does VibeSpell upload my repository?

No. Recipe pages are static, and the generator builds the file in your browser from the options you pick. Your source code never leaves the machine.

Other files for Astro

Cursor security rule for other stacks