Skip to content
vibespell

.cursor/rules/security.mdc

Cursor security rule for FastAPI

A focused Cursor `.mdc` rule for auth, secrets, and untrusted input. It attaches when those files change, instead of repeating security policy in every chat. This copy is written for a FastAPI project. This repository is a FastAPI service. Request and response bodies are Pydantic v2 models. Routes stay async and must not block the event loop.

The example uses a balanced, readable style, pragmatic tests, and comments only where the intent is not obvious. Open the generator to make the agent stricter, switch to test-first, quiet the comments, or pick a different file.

The example assumes FastAPI with Pydantic v2 and pytest. It does not assume a specific database. If the project uses SQLAlchemy, Tortoise, or raw SQL, keep that choice.

Customize in the generatorBrowse the library

Example file

Balanced strictness, readable style, pragmatic tests. Download name: security.mdc

---
description: "Security rules for a FastAPI repository"
globs: "**/*{auth,Auth,secret,config,Config}*"
alwaysApply: false
---

# Security rules

Attach these rules when editing auth, config, or secret-handling code in this FastAPI repository.
This repository is a FastAPI service. Request and response bodies are Pydantic v2 models. Routes stay async and must not block the event loop.

## Secrets and trust

- Do not return ORM objects that include secret columns.
- Use dependencies for auth. Do not trust a user id from the body.
- Keep the service-role or database password out of the repo.

## Errors

- Fail at the boundary. Do not swallow errors.
- Raise `HTTPException` with a stable detail for expected failures. Unexpected errors should propagate to the server log.

## Done when

- Untrusted input is validated before a side effect.
- No secret was added to source, logs, or a client bundle.
- `pytest` passes and `ruff check .` is clean, or you say which tool the repo does not have.

Add it to the project

  1. 01

    Copy a starting file

    Copy the example Cursor security rule on this page, or open the generator if you want different testing, strictness, or comment rules.

  2. 02

    Save it at .cursor/rules/security.mdc

    Save it at `.cursor/rules/security.mdc` in the FastAPI repo. Narrow the globs if your auth and config files live in a known folder.

  3. 03

    Start a fresh agent session

    Rules files are read when a session starts. A chat that is already open may still be using the old instructions.

  4. 04

    Give it one small task

    Ask for one change a FastAPI agent often gets wrong, such as a route that rejects a bad payload with a 422 instead of trusting the dict. If it ignores the file, confirm the path and start a new session.

Questions about this file

Where do I put Cursor security rule in a FastAPI repo?

Save it at `.cursor/rules/security.mdc` in the FastAPI repo. Narrow the globs if your auth and config files live in a known folder.

Which tools read this Cursor security rule?

Cursor loads `.cursor/rules/security.mdc` for files that match its globs. Pair it with the always-on project rule. It is not a substitute for code review.

What does the FastAPI example assume?

The example assumes FastAPI with Pydantic v2 and pytest. It does not assume a specific database. If the project uses SQLAlchemy, Tortoise, or raw SQL, keep that choice.

Does VibeSpell upload my repository?

No. Recipe pages are static, and the generator builds the file in your browser from the options you pick. Your source code never leaves the machine.

Other files for FastAPI

Cursor security rule for other stacks