Any language

Security guardrails rules for Cursor

Baseline rules that stop agents from leaking secrets or weakening auth.

The rule

Save as .cursor/rules/security.mdc. Cursor picks it up on the next request.

.cursor/rules/security.mdc

---
description: Security guardrails for all code changes
alwaysApply: true
---

- Never hard-code secrets, tokens or passwords. Read them from environment variables.
- Do not print or log secrets, even while debugging.
- Use parameterized queries; never build SQL with string concatenation.
- Do not disable TLS verification, CSRF protection or auth checks to make something work.
- Ask before adding a new dependency, and prefer well-maintained packages.

How Cursor loads this rule

Read from the frontmatter above, per Cursor's rules documentation.

alwaysApply: true: included in every chat session. Globs and description are ignored.
Keep the .mdc extension. A plain .md file in .cursor/rules is ignored by the rules system.
Prefer to generate your own? Type /create-rule in Agent and describe what you want; Cursor saves the file to .cursor/rules.
Team Rules come first, then Project Rules like this one, then User Rules. Earlier sources win when guidance conflicts.

Cursor rules setup guide Cursor Team Rules Let Cursor run commands without asking

Using another agent too?

The same instructions work as plain Markdown in AGENTS.md, which Codex, Gemini CLI, GitHub Copilot and most other coding agents read.

AGENTS.md (section)

## Security guardrails

- Never hard-code secrets, tokens or passwords. Read them from environment variables.
- Do not print or log secrets, even while debugging.
- Use parameterized queries; never build SQL with string concatenation.
- Do not disable TLS verification, CSRF protection or auth checks to make something work.
- Ask before adding a new dependency, and prefer well-maintained packages.

More templates

Next.js App Router TypeScript (strict)React components Python FastAPI Fastify Node.js and Express Go Rust Data science notebooks and pipelines Testing discipline

Get Cursor rules and settings changes by email

When Cursor changes how rules, run modes or settings work, we update these templates from the docs and send a short note. One email a week at most.

Reviewed Oct 17, 2026. Written by AgentAtlas. Adapt it to your codebase before relying on it.