Skip to content
vibespell

.cursor/rules/security.mdc

Cursor security rule for Spring Boot

A focused Cursor `.mdc` rule for auth, secrets, and untrusted input. It attaches when those files change, instead of repeating security policy in every chat. This copy is written for a Spring Boot project. This repository is a Spring Boot service. Controllers stay thin, transactions sit on the service the project already uses, and configuration comes from the environment.

The example uses a balanced, readable style, pragmatic tests, and comments only where the intent is not obvious. Open the generator to make the agent stricter, switch to test-first, quiet the comments, or pick a different file.

The example assumes Spring Boot with Maven or Gradle, whichever wrapper is in the repo. It does not assume WebFlux versus MVC, or a particular database. Follow the stack that is already on the classpath.

Customize in the generatorBrowse the library

Example file

Balanced strictness, readable style, pragmatic tests. Download name: security.mdc

---
description: "Security rules for a Spring Boot repository"
globs: "**/*{auth,Auth,secret,config,Config}*"
alwaysApply: false
---

# Security rules

Attach these rules when editing auth, config, or secret-handling code in this Spring Boot repository.
This repository is a Spring Boot service. Controllers stay thin, transactions sit on the service the project already uses, and configuration comes from the environment.

## Secrets and trust

- Authorize with method security or security filter rules the project already uses.
- Do not log Authorization headers.
- Bind request DTOs explicitly. Do not bind straight onto an entity.

## Errors

- Fail at the boundary. Do not swallow errors.
- Use the project's exception handler for expected failures. A validation failure is 400, a missing row is 404.

## Done when

- Untrusted input is validated before a side effect.
- No secret was added to source, logs, or a client bundle.
- The module's tests pass. Use the Maven wrapper if it is present, otherwise the Gradle wrapper.

Add it to the project

  1. 01

    Copy a starting file

    Copy the example Cursor security rule on this page, or open the generator if you want different testing, strictness, or comment rules.

  2. 02

    Save it at .cursor/rules/security.mdc

    Save it at `.cursor/rules/security.mdc` in the Spring Boot repo. Narrow the globs if your auth and config files live in a known folder.

  3. 03

    Start a fresh agent session

    Rules files are read when a session starts. A chat that is already open may still be using the old instructions.

  4. 04

    Give it one small task

    Ask for one change a Spring Boot agent often gets wrong, such as a request DTO with Bean Validation that returns 400 on a bad body. If it ignores the file, confirm the path and start a new session.

Questions about this file

Where do I put Cursor security rule in a Spring Boot repo?

Save it at `.cursor/rules/security.mdc` in the Spring Boot repo. Narrow the globs if your auth and config files live in a known folder.

Which tools read this Cursor security rule?

Cursor loads `.cursor/rules/security.mdc` for files that match its globs. Pair it with the always-on project rule. It is not a substitute for code review.

What does the Spring Boot example assume?

The example assumes Spring Boot with Maven or Gradle, whichever wrapper is in the repo. It does not assume WebFlux versus MVC, or a particular database. Follow the stack that is already on the classpath.

Does VibeSpell upload my repository?

No. Recipe pages are static, and the generator builds the file in your browser from the options you pick. Your source code never leaves the machine.

Other files for Spring Boot

Cursor security rule for other stacks