Windsurf rules

1# Security and API Key Management
2 
3**Activation Mode**: Always On
4 
5<security_guidelines>
6- NEVER commit API keys, secrets, or credentials to version control
7- Always use environment variables for sensitive data and AI service keys
8- Create .env.example files to document required environment variables
9- Implement proper API key rotation and management patterns
10- Use secure storage solutions for production deployments
11</security_guidelines>
12 
13<data_privacy>
14- Avoid sending sensitive user data to AI services without proper consent
15- Implement data anonymization where possible for AI training and processing
16- Follow GDPR and privacy regulations in AI data handling
17- Document data usage and retention policies for AI services
18- Validate all inputs before sending to AI services to prevent injection attacks
19</data_privacy>
20 
21<api_security>
22- Implement proper CORS settings for AI API endpoints
23- Use HTTPS for all AI API communications and service integrations
24- Implement proper rate limiting and authentication for AI endpoints
25- Regularly audit and rotate API keys and secrets
26- Use middleware for common AI service authentication operations
27</api_security>