The rules real projects give Cursor's agent, from .cursor/rules.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
darknecrocitiesCursor ruledarknecrocities/SkillBuilder/.cursor/rules/aws.mdc
Amazon Web Services resilient cloud architecture, serverless Lambda execution, S3 bucket security, DynamoDB single-table design, and IAM least privilege.
RatimonReads credentialsCursor ruleRatimon/openquok-monorepo/.cursor/rules/security-guidelines.mdc
Security — no service client in client code, no SUPABASE_SECRET_KEY on client, RLS, correct Supabase client per context, rate limit config, SSR state rules (no authenticationRepository in server load, ssr = false for protected routes)
raye-dengCursor ruleraye-deng/open-code-review/.cursor/rules/open-code-review.mdc
Open Code Review - AI code quality gate for detecting hallucinated packages, stale APIs, context breaks, security anti-patterns, and over-engineering in AI-generated code.
darknecrocitiesCursor ruledarknecrocities/SkillBuilder/.cursor/rules/devops.mdc
Architect, implement, and maintain secure cloud infrastructure on GCP/AWS, multi-stage non-root Docker containers, Terraform IaC, CI/CD pipelines, and OpenTelemetry observability.
KangaKodeCursor ruleKangaKode/universal-agent-bootstrap/.cursor/rules/code-reviewer.mdc
Code review quality gate — enforces architecture, code quality, and security conventions. Use proactively after any code change.
KangaKodeReads credentialsCursor ruleKangaKode/universal-agent-bootstrap/.cursor/rules/red-team.mdc
Adversarial security gate — blocks commits with secrets, injection vulnerabilities, SSRF, and authorization failures. Run before every commit.
kgrizz-gitCursor rulekgrizz-git/AgentsConfigHelper/.cursor/rules/codeguard-0-client-side-web-security.mdc
Client-side web security (XSS/DOM XSS, CSP, CSRF, clickjacking, XS-Leaks, third-party JS)
afaraha8403Cursor ruleafaraha8403/balakit/.cursor/rules/seo-ai-search.mdc
Universal guidelines for SEO and AI-search implementation — meta tags, JSON-LD, llms.txt, crawlability, and adversarial security.
Ame-AlReads credentialsCursor ruleAme-Al/ame/.cursor/rules/sim-sandbox.mdc
Isolated-vm sandbox worker security policy. Hard rules for anything that lives in the worker child process that runs user code.
galyarderlabsReads credentialsCursor rulegalyarderlabs/galyarder-framework/.cursor/rules/security-reviewer.mdc
Security vulnerability detection and remediation specialist. Use PROACTIVELY after writing code that handles user input, authentication, API endpoints, or sensitive data. Flags secrets, SSRF, injection, unsafe crypto, and OWASP Top 10 vulnerabilities.
Surya8991Cursor ruleSurya8991/AgentMaster/.cursor/rules/codereview.mdc
Blunt, factual code review. No sugar coating. Finds bugs, security issues, performance problems, and architecture flaws. Use when user says /codereview or asks to review code.
anmolnagpalReads credentialsCursor ruleanmolnagpal/devops-skills/.cursor/rules/github-actions.mdc
GitHub Actions workflow review, scaffolding, and security hardening. Use when user says 'review my workflow', 'check my actions', 'scaffold a workflow', 'is my CI correct', 'pin actions', 'OIDC to AWS', or when working in .github/workflows/*.yml files.
codegobrrrr9Reads credentialsCursor rulecodegobrrrr9/seatbelt/.cursor/rules/seatbelt.mdc
seatbelt — pre-ship safety rules. Stops secrets in client code or git, tables without row security, routes without auth, open CORS, unverified webhooks.
Fadi88Cursor ruleFadi88/one-man-startup/.cursor/rules/agent-security.mdc
Reviews designs and diffs for security and privacy risk - auth, access control, secrets, injection, dependencies, data exposure. It writes its report and never changes code. Use on any feature touching accounts, payments, personal data, file upload or a new integration.
PsylinksSecurityWebCursor rulePsylinksSecurityWeb/PsyLinks-360-Security/.cursor/rules/psylinks-360-security.mdc
Apply PsyLinks 360° Security Review when working on authentication, APIs, backend services, databases, secrets, dependencies, deployment, or AI-agent/MCP workflows.
galyarderlabsCursor rulegalyarderlabs/galyarder-framework/.cursor/rules/audit-website.mdc
Audit websites for SEO, performance, security, technical, content, and 15 other issue cateories with 230+ rules using the squirrelscan CLI. Returns LLM-optimized reports with health scores, broken links, meta tag analysis, and actionable recommendations. Use to discover and asses website or webapp issues and health.
wuisabel-gifCursor rulewuisabel-gif/HAL/.cursor/rules/capability-security-review.mdc
Capability-security review of PRs, diffs, or third-party/plugin code — apply when reviewing pull requests, auditing contributed code, or judging whether code is safe.
andr-caReads credentialsCursor ruleandr-ca/agentharness/.cursor/rules/code-review.mdc
Use when reviewing a diff, pull request, or code change — systematic checklist for correctness, clarity, security, testability, and adherence to the project's conventions. Covers what to look for, how to give actionable feedback, and when to approve vs. request changes.
vantionlabsCursor rulevantionlabs/saas-starter/.cursor/rules/effect-sql-rls.mdc
Use when writing any query, migration, or test that touches tenant data in this repository. Covers withOrgScope and withWorkerScope, the two Postgres roles and why the boundary is in the database rather than in a lint rule, the shape a row-level security policy has to take, when Effect.orDie is right, and why a fixture seeds through the product's own write path.
abxn4rReads credentialsCursor ruleabxn4r/archon-skills/.cursor/rules/saltzer.mdc
ALWAYS invoke when the user mentions Saltzer (e.g., 'Saltzer', 'ask Saltzer', 'run Saltzer', 'consult Saltzer') or asks for security review, vulnerability assessment, pen-testing, or pre-release audit. Principal Application
Instruction files for Cursor's agent, kept in .cursor/rules/ as .mdc files.
A rule can apply only to files matching a pattern, or only when the agent asks for it. AGENTS.md always applies.
Copy the .mdc file into your project's .cursor/rules/ directory and adjust its globs.
Open a rule to see its discussion. Reports from people and their agents are coming.
