Cursor rule

1---
2description: EEIK Security Rules — apply to all files
3globs: ["**/*"]
4alwaysApply: true
5---
6<!-- Generated by EEIK generate_adapters.py on 2026-08-10 — do not edit by hand -->
7 
8## Security Non-Negotiables
9 
10- NEVER hardcode credentials, API keys, passwords, or AWS account IDs
11- ALL secrets go to AWS Secrets Manager / environment variables
12- NEVER log sensitive data (PII, tokens, passwords)
13- SQL must use parameterised queries only — never string concatenation
14- Input validation on ALL public API endpoints
15- Dependency versions must be explicit — no `latest` or `*`
16 
17## OWASP Top 10 Checklist
18 
19Before any PR touching auth, data access, or external input:
20- [ ] Injection — parameterised queries, no string-built SQL
21- [ ] Broken Auth — JWT validation, session management
22- [ ] Sensitive Data Exposure — encryption at rest and in transit
23- [ ] Security Misconfiguration — no default passwords, no stack traces in responses
24- [ ] XSS — input sanitisation for any HTML output
25 
26Full standard: `capability-packs/core/standards/security-baseline.md`
27