Skip to content
vibespell

.cursor/rules/security.mdc

Cursor security rule for Unity

A focused Cursor `.mdc` rule for auth, secrets, and untrusted input. It attaches when those files change, instead of repeating security policy in every chat. This copy is written for a Unity project. This repository is a Unity project in C#. Compose behavior with components, expose inspector values with SerializeField, and keep the Unity API on the main thread.

The example uses a balanced, readable style, pragmatic tests, and comments only where the intent is not obvious. Open the generator to make the agent stricter, switch to test-first, quiet the comments, or pick a different file.

The example assumes Unity LTS and C# MonoBehaviours. It does not assume Netcode, Addressables, or a particular input system. If the project uses the new Input System or a custom framework, follow that.

Customize in the generatorBrowse the library

Example file

Balanced strictness, readable style, pragmatic tests. Download name: security.mdc

---
description: "Security rules for a Unity repository"
globs: "**/*{auth,Auth,secret,config,Config}*"
alwaysApply: false
---

# Security rules

Attach these rules when editing auth, config, or secret-handling code in this Unity repository.
This repository is a Unity project in C#. Compose behavior with components, expose inspector values with SerializeField, and keep the Unity API on the main thread.

## Secrets and trust

- Do not ship API keys in a client build or a ScriptableObject.
- Validate server responses. The player can patch the client.
- Do not trust a client-reported score, inventory, or purchase.

## Errors

- Fail at the boundary. Do not swallow errors.
- Log with context (`Debug.LogError(message, this)`) for unexpected states. Disable the component or skip the frame for a missing optional reference, and say which reference.

## Done when

- Untrusted input is validated before a side effect.
- No secret was added to source, logs, or a client bundle.
- The script compiles in the Editor, and you ran the Test Runner or Play Mode for the scene you touched.

Add it to the project

  1. 01

    Copy a starting file

    Copy the example Cursor security rule on this page, or open the generator if you want different testing, strictness, or comment rules.

  2. 02

    Save it at .cursor/rules/security.mdc

    Save it at `.cursor/rules/security.mdc` in the Unity repo. Narrow the globs if your auth and config files live in a known folder.

  3. 03

    Start a fresh agent session

    Rules files are read when a session starts. A chat that is already open may still be using the old instructions.

  4. 04

    Give it one small task

    Ask for one change a Unity agent often gets wrong, such as a component that moves work out of Update when it only needs to react to an event. If it ignores the file, confirm the path and start a new session.

Questions about this file

Where do I put Cursor security rule in a Unity repo?

Save it at `.cursor/rules/security.mdc` in the Unity repo. Narrow the globs if your auth and config files live in a known folder.

Which tools read this Cursor security rule?

Cursor loads `.cursor/rules/security.mdc` for files that match its globs. Pair it with the always-on project rule. It is not a substitute for code review.

What does the Unity example assume?

The example assumes Unity LTS and C# MonoBehaviours. It does not assume Netcode, Addressables, or a particular input system. If the project uses the new Input System or a custom framework, follow that.

Does VibeSpell upload my repository?

No. Recipe pages are static, and the generator builds the file in your browser from the options you pick. Your source code never leaves the machine.

Other files for Unity

Cursor security rule for other stacks