Cursor rule

1---
2description: Security, performance, and code quality standards for Compozy development including linter rules, security requirements, and performance guidelines
3globs:
4  - "**/*.go"
5  - "**/Makefile"
6  - "**/*.yml"
7  - "**/*.yaml"
8alwaysApply: true
9---
10# Quality and Security Standards
11 
12## Security
13 
14<security_requirements type="critical">
15- **NEVER commit API keys or secrets** - use environment variables
16- **NEVER expose secrets in logs** - use structured logging without sensitive data
17- **Handle redaction markers:** `[REDACTED:amp-token]` indicates removed secrets - do not overwrite with markers
18- Use the gosec linter to identify security issues
19- Validate all inputs, especially those from external sources
20- Follow secure coding practices for authentication and authorization
21</security_requirements>
22 
23## Performance
24 
25<performance_guidelines>
26- Minimize allocations in hot paths
27- Consider resource usage and efficiency
28</performance_guidelines>
29 
30## Specific Linter Rules to Follow
31 
32<linter_rules type="mandatory">
33- **bodyclose**: Always close HTTP response bodies
34- **errcheck**: Check error returns from all function calls
35- **goconst**: Extract repeated string literals into constants
36- **gocritic**: Follow idiomatic Go practices
37- **staticcheck**: Address all static analysis warnings
38- **unused**: Remove unused code
39- **whitespace**: Maintain consistent whitespace
40</linter_rules>
41