Skip to content
vibespell

.cursor/rules/security.mdc

Cursor security rule for .NET

A focused Cursor `.mdc` rule for auth, secrets, and untrusted input. It attaches when those files change, instead of repeating security policy in every chat. This copy is written for a .NET project. This repository is a .NET application. Nullable reference types stay enabled. Match minimal APIs or controllers, whichever the project already uses, and ship schema changes as migrations.

The example uses a balanced, readable style, pragmatic tests, and comments only where the intent is not obvious. Open the generator to make the agent stricter, switch to test-first, quiet the comments, or pick a different file.

The example assumes modern .NET with nullable enabled. It does not assume MVC versus minimal APIs, or EF Core versus another store. Follow the host that is already in Program.cs.

Customize in the generatorBrowse the library

Example file

Balanced strictness, readable style, pragmatic tests. Download name: security.mdc

---
description: "Security rules for a .NET repository"
globs: "**/*{auth,Auth,secret,config,Config}*"
alwaysApply: false
---

# Security rules

Attach these rules when editing auth, config, or secret-handling code in this .NET repository.
This repository is a .NET application. Nullable reference types stay enabled. Match minimal APIs or controllers, whichever the project already uses, and ship schema changes as migrations.

## Secrets and trust

- Authorize with the existing policy. Do not check a role string ad hoc in one action.
- Do not log tokens or connection strings.
- Keep secrets in user-secrets or the environment, not in a committed appsettings file.

## Errors

- Fail at the boundary. Do not swallow errors.
- Return a ProblemDetails or the project's error type for expected failures. Unexpected exceptions hit the exception handler.

## Done when

- Untrusted input is validated before a side effect.
- No secret was added to source, logs, or a client bundle.
- `dotnet test` passes and `dotnet format` leaves the diff clean.

Add it to the project

  1. 01

    Copy a starting file

    Copy the example Cursor security rule on this page, or open the generator if you want different testing, strictness, or comment rules.

  2. 02

    Save it at .cursor/rules/security.mdc

    Save it at `.cursor/rules/security.mdc` in the .NET repo. Narrow the globs if your auth and config files live in a known folder.

  3. 03

    Start a fresh agent session

    Rules files are read when a session starts. A chat that is already open may still be using the old instructions.

  4. 04

    Give it one small task

    Ask for one change a .NET agent often gets wrong, such as an endpoint that returns a validation problem for a bad body instead of throwing. If it ignores the file, confirm the path and start a new session.

Questions about this file

Where do I put Cursor security rule in a .NET repo?

Save it at `.cursor/rules/security.mdc` in the .NET repo. Narrow the globs if your auth and config files live in a known folder.

Which tools read this Cursor security rule?

Cursor loads `.cursor/rules/security.mdc` for files that match its globs. Pair it with the always-on project rule. It is not a substitute for code review.

What does the .NET example assume?

The example assumes modern .NET with nullable enabled. It does not assume MVC versus minimal APIs, or EF Core versus another store. Follow the host that is already in Program.cs.

Does VibeSpell upload my repository?

No. Recipe pages are static, and the generator builds the file in your browser from the options you pick. Your source code never leaves the machine.

Other files for .NET

Cursor security rule for other stacks