Skip to content
vibespell

.cursor/rules/security.mdc

Cursor security rule for Node.js

A focused Cursor `.mdc` rule for auth, secrets, and untrusted input. It attaches when those files change, instead of repeating security policy in every chat. This copy is written for a Node.js project. This repository is a TypeScript program on Node.js. Use ESM if the package already does, and prefer `node:` imports for built-in modules. The default test runner, when one is needed, is node:test.

The example uses a balanced, readable style, pragmatic tests, and comments only where the intent is not obvious. Open the generator to make the agent stricter, switch to test-first, quiet the comments, or pick a different file.

The example assumes TypeScript on modern Node. It does not assume Express, Fastify, or a database. Do not add a framework if the repo is a library or a small script.

Customize in the generatorBrowse the library

Example file

Balanced strictness, readable style, pragmatic tests. Download name: security.mdc

---
description: "Security rules for a Node.js repository"
globs: "**/*{auth,Auth,secret,config,Config}*"
alwaysApply: false
---

# Security rules

Attach these rules when editing auth, config, or secret-handling code in this Node.js repository.
This repository is a TypeScript program on Node.js. Use ESM if the package already does, and prefer `node:` imports for built-in modules. The default test runner, when one is needed, is node:test.

## Secrets and trust

- Read process.env once at the boundary. Do not scatter secrets through the tree.
- Validate untrusted JSON before it reaches business logic.
- Do not log authorization headers or request bodies that may contain tokens.

## Errors

- Fail at the boundary. Do not swallow errors.
- Throw an Error, or return a Result-style value if the file already does. Include the operation that failed.

## Done when

- Untrusted input is validated before a side effect.
- No secret was added to source, logs, or a client bundle.
- `npx tsc --noEmit` passes for the project, and `npm test` passes when tests exist.

Add it to the project

  1. 01

    Copy a starting file

    Copy the example Cursor security rule on this page, or open the generator if you want different testing, strictness, or comment rules.

  2. 02

    Save it at .cursor/rules/security.mdc

    Save it at `.cursor/rules/security.mdc` in the Node.js repo. Narrow the globs if your auth and config files live in a known folder.

  3. 03

    Start a fresh agent session

    Rules files are read when a session starts. A chat that is already open may still be using the old instructions.

  4. 04

    Give it one small task

    Ask for one change a Node.js agent often gets wrong, such as a function that validates its input and returns a typed error instead of throwing a string. If it ignores the file, confirm the path and start a new session.

Questions about this file

Where do I put Cursor security rule in a Node.js repo?

Save it at `.cursor/rules/security.mdc` in the Node.js repo. Narrow the globs if your auth and config files live in a known folder.

Which tools read this Cursor security rule?

Cursor loads `.cursor/rules/security.mdc` for files that match its globs. Pair it with the always-on project rule. It is not a substitute for code review.

What does the Node.js example assume?

The example assumes TypeScript on modern Node. It does not assume Express, Fastify, or a database. Do not add a framework if the repo is a library or a small script.

Does VibeSpell upload my repository?

No. Recipe pages are static, and the generator builds the file in your browser from the options you pick. Your source code never leaves the machine.

Other files for Node.js

Cursor security rule for other stacks