Cursor rule

1# Secret Detection and Warning Rule
2 
3This rule helps identify potential secrets, credentials, and sensitive data in code files to prevent accidental exposure or leakage. It provides warnings when secrets are detected and suggests best practices for secure secret management.
4 
5<rule>
6name: secret_detection_warning
7description: Detect and warn about potential secrets and sensitive data in code files
8filters:
9  - type: file_extension
10    pattern: "\\.(php|js|py|ts|jsx|tsx|java|rb|go|cs|c|cpp|h|hpp|ini|conf|yaml|yml|json|xml|properties|env|config|sh|bash|zsh)$"
11  - type: file_path
12    pattern: ".*"
13    exclude: "(node_modules|vendor|bower_components|.git|.yarn|dist|build|out|\\.bundle|cache)"
14 
15actions:
16  - type: enforce
17    conditions:
18      # Generic API Keys, Tokens, and Credentials
19      - pattern: "(?i)(api[_-]?key|apikey|api[_-]?secret|apisecret|app[_-]?key|appkey|app[_-]?secret|access[_-]?key|accesskey|access[_-]?token|auth[_-]?key|authkey|client[_-]?secret|consumer[_-]?key|consumer[_-]?secret|oauth[_-]?token|token)[\\s]*[=:]\\s*['\\\"](\\w|[\\-]){16,}['\\\"]"
20        message: "Potential API key or secret detected. Consider using environment variables or a secure secrets manager instead of hardcoding sensitive values."
21 
22      # AWS Keys and Tokens
23      - pattern: "(?i)(aws[_-]?access[_-]?key|aws[_-]?secret[_-]?key|aws[_-]?account[_-]?id)[\\s]*[=:]\\s*['\\\"](\\w|[\\-]){16,}['\\\"]"
24        message: "Potential AWS key detected. AWS credentials should be stored securely using AWS SDK credential providers, environment variables, or a secrets manager."
25 
26      # Google Cloud and Firebase
27      - pattern: "(?i)(google[_-]?api[_-]?key|google[_-]?cloud[_-]?key|firebase[_-]?api[_-]?key)[\\s]*[=:]\\s*['\\\"](\\w|[\\-]){16,}['\\\"]"
28        message: "Potential Google Cloud or Firebase key detected. Use environment variables or a secure secrets manager to store these credentials."
29 
30      # Azure and Microsoft
31      - pattern: "(?i)(azure[_-]?key|azure[_-]?connection[_-]?string|microsoft[_-]?key)[\\s]*[=:]\\s*['\\\"](\\w|[\\-]){16,}['\\\"]"
32        message: "Potential Azure or Microsoft key detected. Use Azure Key Vault, environment variables, or a secure secrets manager instead of hardcoding credentials."
33 
34      # Database Connection Strings and Credentials
35      - pattern: "(?i)(jdbc:|mongodb[\\+]?://|postgres://|mysql://|database[_-]?url|connection[_-]?string)[^\\n]{10,}(password|pwd)[^\\n]{3,}"
36        message: "Potential database connection string with credentials detected. Use environment variables or a secure configuration manager for database connections."
37 
38      # Database Credentials
39      - pattern: "(?i)(db[_-]?password|mysql[_-]?password|postgres[_-]?password|mongo[_-]?password|database[_-]?password)[\\s]*[=:]\\s*['\\\"][^\\s]{3,}['\\\"]"
40        message: "Potential database password detected. Store database credentials in environment variables or use a secure configuration manager."
41 
42      # Private Keys and Certificates
43      - pattern: "(?i)-----(BEGIN|END) (RSA |DSA |EC )?(PRIVATE KEY|CERTIFICATE)-----"
44        message: "Private key or certificate material detected. Never include these directly in code - store them securely and reference them from protected locations."
45 
46      # SSH Keys
47      - pattern: "(?i)ssh-rsa AAAA[0-9A-Za-z+/]+[=]{0,3}"
48        message: "SSH key detected. SSH keys should be managed securely and never included directly in code files."
49 
50      # Passwords
51      - pattern: "(?i)(password|passwd|pwd|secret)[\\s]*[=:]\\s*['\\\"][^\\s]{3,}['\\\"]"
52        message: "Potential password detected. Never hardcode passwords in code files. Use environment variables or a secure secrets manager."
53 
54      # OAuth Tokens
55      - pattern: "(?i)(bearer|oauth|access[_-]?token)[\\s]*[=:]\\s*['\\\"][\\w\\d\\-_.]{30,}['\\\"]"
56        message: "Potential OAuth token detected. Store tokens securely and consider implementing proper token rotation."
57 
58      # JWT Tokens
59      - pattern: "(?i)ey[a-zA-Z0-9]{20,}\\.ey[a-zA-Z0-9\\-_]{20,}\\.[a-zA-Z0-9\\-_]{20,}"
60        message: "JWT token detected. Never hardcode JWT tokens directly in your code."
61 
62      # GitHub Tokens
63      - pattern: "(?i)gh[pousr]_[a-zA-Z0-9]{20,}"
64        message: "GitHub token detected. GitHub tokens should be stored securely in environment variables or a secrets manager."
65 
66      # Slack Tokens
67      - pattern: "(?i)(xox[pbar]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32})"
68        message: "Slack token detected. Store Slack tokens securely using environment variables or a secrets manager."
69 
70      # Stripe API Keys
71      - pattern: "(?i)(sk|pk)_(test|live)_[0-9a-zA-Z]{24,}"
72        message: "Stripe API key detected. Store Stripe keys securely in environment variables or a secrets manager."
73 
74      # Generic Encryption Keys
75      - pattern: "(?i)(encryption[_-]?key|cipher[_-]?key|aes[_-]?key)[\\s]*[=:]\\s*['\\\"][\\w\\d\\-_.]{16,}['\\\"]"
76        message: "Potential encryption key detected. Encryption keys should be managed securely and never hardcoded."
77 
78      # .env or config files with credentials
79      - pattern: "(?i)(DB_PASSWORD|API_KEY|SECRET_KEY|ADMIN_PASSWORD)[\\s]*=[\\s]*['\"]?[\\w\\d\\-_.]{3,}['\"]?"
80        message: "Environment variable with credential detected. Make sure .env files are included in .gitignore and .cursorignore."
81 
82      # IP Addresses (if they appear with credentials)
83      - pattern: "(?i)(username|password|login|credential)[^\\n]{3,}(?:\\d{1,3}\\.){3}\\d{1,3}"
84        message: "IP address detected near potential credentials. Consider using DNS names and storing connection details securely."
85 
86  - type: suggest
87    message: |
88      **Secure Secret Management Best Practices:**
89      
90      1. **Never hardcode secrets in source code**
91         - Secrets in code can be exposed via version control, logs, or screenshots
92         - Code is often shared, backed up, and stored in multiple locations
93      
94      2. **Use environment variables for configuration**
95         - Load secrets from environment variables at runtime
96         - Use libraries like dotenv, but ensure .env files are in .gitignore
97         - Example: `API_KEY=os.environ.get("API_KEY")`
98      
99      3. **Implement secret rotation**
100         - Regularly rotate credentials and keys
101         - Use short-lived tokens when possible
102         - Implement proper secret lifecycle management
103      
104      4. **Use secrets management solutions**
105         - AWS Secrets Manager, Azure Key Vault, HashiCorp Vault
106         - Platform-specific solutions like Kubernetes Secrets
107         - These provide encryption, access control, and audit trails
108      
109      5. **Implement access controls**
110         - Limit who can access secrets
111         - Use the principle of least privilege
112         - Implement proper authentication for secret access
113      
114      6. **Use .gitignore and .cursorignore**
115         - Add patterns for files that might contain secrets
116         - Example patterns: `.env`, `*.key`, `*secret*`, `*.pem`
117         - Verify these files are not committed to version control
118      
119      7. **Consider using secure by default libraries**
120         - Libraries that separate configuration from code
121         - Frameworks with built-in secrets management
122         - Encryption libraries with secure defaults
123      
124      8. **Implement detection tools**
125         - Use pre-commit hooks to prevent secret leakage
126         - Implement scanning in CI/CD pipelines
127         - Consider tools like git-secrets, trufflehog, or detect-secrets
128      
129      9. **Audit and monitor**
130         - Regularly audit code for leaked secrets
131         - Monitor for unauthorized access to secrets
132         - Implement alerts for potential compromises
133      
134      10. **Educate your team**
135          - Train developers on secure secret management
136          - Establish clear procedures for handling secrets
137          - Create a response plan for leaked credentials
138 
139  - type: validate
140    conditions:
141      - pattern: "(?i)import\\s+os\\s*;?\\s*.*\\s+os\\.environ(\\.get)?"
142        message: "Environment variable usage detected, which is a good practice for managing secrets."
143      
144      - pattern: "(?i)process\\.env\\."
145        message: "Environment variable usage in JavaScript detected, which is a good practice for managing secrets."
146      
147      - pattern: "(?i)dotenv"
148        message: "Dotenv library usage detected, which can help with environment variable management."
149      
150      - pattern: "(?i)(secret[s]?[_-]?manager|key[_-]?vault|hashicorp|vault)"
151        message: "Secret management solution reference detected, which is a best practice for handling secrets."
152 
153metadata:
154  priority: high
155  version: 1.0
156  tags:
157    - category:security
158    - subcategory:secrets
159    - subcategory:sensitive-data
160    - language:all
161    - priority:critical
162  references:
163    - "https://owasp.org/www-community/vulnerabilities/Hardcoded_credentials"
164    - "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html"
165    - "https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning"
166    - "https://cloud.google.com/secret-manager/docs/best-practices"
167    - "https://aws.amazon.com/blogs/security/how-to-use-aws-secrets-manager-securely-store-rotate-deploy-database-credentials/"
168</rule>