“security-devsecops-ssdls-appsec” is a ready-made rule for Security, built for Cursor. Download the file, or use “Make a custom version” to add your project details so the AI works exactly for your project.
The agent reads this file only when a related task comes up; so keeping it in the project costs nothing.
Never hardcode secrets, credentials, or API keys. Use environment variables or secure vaults for sensitive data.
Prohibit the inclusion of .env, secret config files, or unknown tokens in source control.
Never log sensitive data, secrets, or session tokens in application logs.
Validate and sanitize all user input. Escape output in HTML, JS, and SQL contexts.
Avoid unsafe functions such as exec, eval, or similar dynamic code execution.
Database Security
Use parameterized queries or ORM for all database access. Do not use string concatenation for query building.
Ensure database users have the least privilege required for their tasks.
Regularly review and update database access policies.
Dependency Management
Only use packages from verified sources.
Do not add new dependencies without explicit approval and security review.
Regularly update dependencies and scan for known vulnerabilities (SCA).
Authentication & Authorization
Use secure authentication frameworks; never implement custom authentication.
Store passwords using strong, salted hashes (e.g., Argon2, bcrypt).
Implement Role-Based Access Control (RBAC) for sensitive operations.
Enforce the principle of least privilege for APIs and UI actions.
Secure SDLC Practices
Integrate Static Application Security Testing (SAST) and Software Composition Analysis (SCA) into the CI pipeline.
Scan all code for secrets before merging (Secret Scanning).
Use Infrastructure as Code (IaC) scanning for all infrastructure code.
Integrate Dynamic Application Security Testing (DAST) in the CD pipeline for deployed applications.
Enforce Policy as Code (PaC) for automated, version-controlled security policies.
Monitoring & Feedback
Enable continuous vulnerability monitoring and alerting.
Integrate Runtime Application Self-Protection (RASP) and Web Application Firewall (WAF) as appropriate.
Encourage regular vulnerability assessments and penetration testing.
Maintain a feedback loop to update rules and prompts based on recurring vulnerabilities.
Compliance & Documentation
Align with industry standards (e.g., OWASP Top 10, NIST, ISO 27001).
Document all security controls and decisions for auditability.
Build a custom version for your project
Write your project details; to the end of Rule is added, and you get a file that is given to the AI without extra explanation. Everything is built in your browser and no data goes to the server.
Preview of the final file
Where do I put the file?
Claude Code.claude/skills/security-devsecops-ssdls-appsec/SKILL.md
Team projects: commit the file to the repository so every agent on the team follows the same rules. With Build a bundle Get several skills together, with the correct structure.
Frequently asked questions
Rule “security-devsecops-ssdls-appsec” — where do I put it?
for Claude Code in .claude/skills/security-devsecops-ssdls-appsec/SKILL.md, for Codex in .agents/skills, for Copilot in .github/skills and for Cursor in .cursor/skills or .cursor/rules. Use the “Build a bundle” button to get a zip with the correct structure.
Can I modify it for my own project?
Yes. The license CC0-1.0 allows modification and commercial use. With “Build a custom version” your project's details are added to the file, and you can edit the text afterward.
This Rule Which tools does it work with?
With Cursor. Standard Agent Skills are read by all modern coding agents.
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when…
Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.
Security hardening reviewer for GitHub Actions workflow files (.github/workflows/*.yml). Reasons about the Actions threat model that pattern matchers and general code linters miss — untrusted-input script injection, privileged triggers running…
Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse engineering packed binaries,…
Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.
Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation.
