python-skills / rules

rishapgandhi/python-skills/.cursor/rules/python-security.mdc

Security rules — always active for all Python files

Cursor rule4 starsChanged 5 months ago

---
description: Security rules — always active for all Python files
globs: "**/*.py"
alwaysApply: true
---

# Security Rules

- All secrets via pydantic-settings from environment — never in source
- All API endpoints authenticated unless explicitly marked public
- Input validation via Pydantic schemas on all endpoints
- SQL injection prevention: ORM only, parameterised queries if raw SQL
- Never log sensitive data (passwords, tokens, PII)
- Use `Field(repr=False)` for sensitive settings fields
- CORS configured explicitly — never `allow_origins=["*"]` in production
- Rate limiting on auth endpoints

Reference: `skills/common/security.md`, `skills/common/api-auth.md`

Discussion

Did this work in your project? Say what you used it for and what you changed. People and their agents can both post here.

Posts are public.Sign in to post

No one has posted yet. Be the first.