Skip to content
vibespell

.cursor/rules/security.mdc

Cursor security rule for Swift

A focused Cursor `.mdc` rule for auth, secrets, and untrusted input. It attaches when those files change, instead of repeating security policy in every chat. This copy is written for a Swift project. This repository is a Swift app for Apple platforms. Match SwiftUI or UIKit, whichever the target already uses. Stay off the main actor only for work that is actually background work.

The example uses a balanced, readable style, pragmatic tests, and comments only where the intent is not obvious. Open the generator to make the agent stricter, switch to test-first, quiet the comments, or pick a different file.

The example assumes a Swift iOS or multiplatform app. It does not assume SwiftData, a particular architecture acronym, or a third-party UI kit. Follow the UI stack already on screen.

Customize in the generatorBrowse the library

Example file

Balanced strictness, readable style, pragmatic tests. Download name: security.mdc

---
description: "Security rules for a Swift repository"
globs: "**/*{auth,Auth,secret,config,Config}*"
alwaysApply: false
---

# Security rules

Attach these rules when editing auth, config, or secret-handling code in this Swift repository.
This repository is a Swift app for Apple platforms. Match SwiftUI or UIKit, whichever the target already uses. Stay off the main actor only for work that is actually background work.

## Secrets and trust

- Keep keys out of the repository and out of Info.plist when a build setting can inject them.
- Use the Keychain for tokens. UserDefaults is not a secret store.
- Validate universal-link and URL-scheme parameters.

## Errors

- Fail at the boundary. Do not swallow errors.
- Model recoverable failure as a thrown error or a Result the view can show. Do not `try!` on user input.

## Done when

- Untrusted input is validated before a side effect.
- No secret was added to source, logs, or a client bundle.
- The app target builds and the XCTest for the type you changed passes.

Add it to the project

  1. 01

    Copy a starting file

    Copy the example Cursor security rule on this page, or open the generator if you want different testing, strictness, or comment rules.

  2. 02

    Save it at .cursor/rules/security.mdc

    Save it at `.cursor/rules/security.mdc` in the Swift repo. Narrow the globs if your auth and config files live in a known folder.

  3. 03

    Start a fresh agent session

    Rules files are read when a session starts. A chat that is already open may still be using the old instructions.

  4. 04

    Give it one small task

    Ask for one change a Swift agent often gets wrong, such as a view model change that publishes on the main actor and has an XCTest. If it ignores the file, confirm the path and start a new session.

Questions about this file

Where do I put Cursor security rule in a Swift repo?

Save it at `.cursor/rules/security.mdc` in the Swift repo. Narrow the globs if your auth and config files live in a known folder.

Which tools read this Cursor security rule?

Cursor loads `.cursor/rules/security.mdc` for files that match its globs. Pair it with the always-on project rule. It is not a substitute for code review.

What does the Swift example assume?

The example assumes a Swift iOS or multiplatform app. It does not assume SwiftData, a particular architecture acronym, or a third-party UI kit. Follow the UI stack already on screen.

Does VibeSpell upload my repository?

No. Recipe pages are static, and the generator builds the file in your browser from the options you pick. Your source code never leaves the machine.

Other files for Swift

Cursor security rule for other stacks