Skip to content
vibespell

.cursor/rules/security.mdc

Cursor security rule for Roblox

A focused Cursor `.mdc` rule for auth, secrets, and untrusted input. It attaches when those files change, instead of repeating security policy in every chat. This copy is written for a Roblox project. This repository is a Roblox experience in Luau. The server owns the truth. Clients request actions through remotes, and every remote validates its arguments.

The example uses a balanced, readable style, pragmatic tests, and comments only where the intent is not obvious. Open the generator to make the agent stricter, switch to test-first, quiet the comments, or pick a different file.

The example assumes Luau with the project's Rojo or Studio layout. It does not assume a particular framework such as Knit unless the repo already uses it.

Customize in the generatorBrowse the library

Example file

Balanced strictness, readable style, pragmatic tests. Download name: security.mdc

---
description: "Security rules for a Roblox repository"
globs: "**/*{auth,Auth,secret,config,Config}*"
alwaysApply: false
---

# Security rules

Attach these rules when editing auth, config, or secret-handling code in this Roblox repository.
This repository is a Roblox experience in Luau. The server owns the truth. Clients request actions through remotes, and every remote validates its arguments.

## Secrets and trust

- Every RemoteEvent and RemoteFunction checks the player and the payload on the server.
- Do not put admin commands in a client script.
- Rate-limit remotes that grant items or currency.

## Errors

- Fail at the boundary. Do not swallow errors.
- Reject a bad remote with a warn that includes the player and the reason, then return. Do not kick for a single bad packet unless the project already does.

## Done when

- Untrusted input is validated before a side effect.
- No secret was added to source, logs, or a client bundle.
- The server script rejects a wrong-typed remote argument, and the client path you changed still fires.

Add it to the project

  1. 01

    Copy a starting file

    Copy the example Cursor security rule on this page, or open the generator if you want different testing, strictness, or comment rules.

  2. 02

    Save it at .cursor/rules/security.mdc

    Save it at `.cursor/rules/security.mdc` in the Roblox repo. Narrow the globs if your auth and config files live in a known folder.

  3. 03

    Start a fresh agent session

    Rules files are read when a session starts. A chat that is already open may still be using the old instructions.

  4. 04

    Give it one small task

    Ask for one change a Roblox agent often gets wrong, such as a remote that checks the player and the argument types on the server. If it ignores the file, confirm the path and start a new session.

Questions about this file

Where do I put Cursor security rule in a Roblox repo?

Save it at `.cursor/rules/security.mdc` in the Roblox repo. Narrow the globs if your auth and config files live in a known folder.

Which tools read this Cursor security rule?

Cursor loads `.cursor/rules/security.mdc` for files that match its globs. Pair it with the always-on project rule. It is not a substitute for code review.

What does the Roblox example assume?

The example assumes Luau with the project's Rojo or Studio layout. It does not assume a particular framework such as Knit unless the repo already uses it.

Does VibeSpell upload my repository?

No. Recipe pages are static, and the generator builds the file in your browser from the options you pick. Your source code never leaves the machine.

Other files for Roblox

Cursor security rule for other stacks