agentleFS
ysyecustysyecust/everything-claude-code/.cursor/rules/swift-security.md

everything-claude-code / rules

Cursor rule44 starsChanged 5 months agoMITView on GitHub

Swift security extending common rules

  • Reads credentials

We split this swift-security.md into the rules it gives an agent

5 rules. About 0 are common, 2 are distinctive, and 3 are very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈2

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 3

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Very specific:

    Use Keychain Services for sensitive data (tokens, passwords, keys) -- never UserDefaults

    line 12
  2. Very specific:

    Use environment variables or .xcconfig files for build-time secrets

    line 13
  3. Distinctive:

    Never hardcode secrets in source -- decompilation tools extract them trivially

    line 14
  4. Distinctive:

    Use certificate pinning for critical endpoints

    line 26
  5. Very specific:

    Use URL(string:) with validation rather than force-unwrapping

    line 32

≈ “Common” is an estimate: at least 1 in 5 of the 6,350 Cursor rule files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
swift-security.md

Swift Security

This file extends the common security rule with Swift specific content.

Secret Management

  • Use Keychain Services for sensitive data (tokens, passwords, keys) -- never UserDefaults
  • Use environment variables or .xcconfig files for build-time secrets
  • Never hardcode secrets in source -- decompilation tools extract them trivially
let apiKey = ProcessInfo.processInfo.environment["API_KEY"]
guard let apiKey, !apiKey.isEmpty else {
    fatalError("API_KEY not configured")
}

Transport Security

  • App Transport Security (ATS) is enforced by default -- do not disable it
  • Use certificate pinning for critical endpoints
  • Validate all server certificates

Input Validation

  • Sanitize all user input before display to prevent injection
  • Use URL(string:) with validation rather than force-unwrapping
  • Validate data from external sources (APIs, deep links, pasteboard) before processing

Download now (ZIP)

Trending

Steady: 0 new projects took it in the last 4 weeks, none the 4 weeks before.thin data

Week of Aug 30: 0 new projectsWeek of Sep 6: 0 new projectsWeek of Sep 13: 0 new projectsWeek of Sep 20: 0 new projectsWeek of Sep 27: 0 new projectsWeek of Oct 4: 0 new projectsWeek of Oct 11: 0 new projectsWeek of Oct 18: 0 new projects
Aug 2026Sep 2026Oct 2026
New projects taking a version of this file each week, over the 8 weeks our latest run read: only 0 in all, so this is a hint, not a trend.

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

Reviews can't be read right now.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.