Cursor rule

1---
2description: "Security guidelines and API key management best practices"
3globs: ["**/*.env*", "**/*.config.*", "src/lib/**/*", "app/api/**/*"]
4alwaysApply: true
5---
6 
7# Security & API Key Management
8 
9Critical security guidelines for AI development in this repository.
10 
11## Core Security Principles
12 
13### 1. API Key and Credential Management
14- **NEVER** commit API keys, secrets, or credentials to version control
15- Always use environment variables for sensitive data
16- Create `.env.example` files to document required environment variables
17- Implement proper API key rotation and management patterns
18- Use secure storage solutions for production deployments
19 
20### 2. Environment Variable Patterns
21Create `.env.local` with these patterns:
22```env
23# AI Service Keys
24OPENAI_API_KEY=your_openai_key_here
25ANTHROPIC_API_KEY=your_anthropic_key_here
26 
27# Application Settings
28NEXT_PUBLIC_APP_URL=http://localhost:3000
29NODE_ENV=development
30 
31# Database (if needed)
32DATABASE_URL=your_database_url_here
33```
34 
35### 3. Data Privacy Guidelines
36- Avoid sending sensitive user data to AI services
37- Implement data anonymization where possible
38- Follow GDPR and privacy regulations
39- Document data usage and retention policies
40 
41### 4. API Security Best Practices
42- Validate all inputs before sending to AI services
43- Implement proper CORS settings
44- Use HTTPS for all AI API communications
45- Regularly rotate API keys and secrets
46 
47### 5. Error Handling Security
48```javascript
49// Secure error handling - don't expose sensitive details
50try {
51  const response = await aiClient.complete(prompt);
52  return response;
53} catch (error) {
54  // Log detailed error internally
55  logger.error('AI service error', { error, userId: user.id });
56  
57  // Return generic error to client
58  throw new Error('AI service temporarily unavailable');
59}
60```
61 
62### 6. Rate Limiting and Monitoring
63- Implement proper rate limiting for AI API endpoints
64- Monitor API usage and costs
65- Track unusual usage patterns
66- Implement health checks for AI services