Cursor rule

1---
2description: Security best practices for PHP, JavaScript, and Drupal
3globs: *.php, *.js, *.vue, *.jsx, *.tsx
4alwaysApply: false
5---
6# Security Best Practices
7 
8Ensures application security standards are maintained.
9 
10<rule>
11name: security_practices
12description: Enforce security best practices across the application
13filters:
14  - type: file_extension
15    pattern: "\\.(php|js|vue|jsx|tsx)$"
16 
17actions:
18  - type: enforce
19    conditions:
20      - pattern: "eval\\("
21        message: "Avoid using eval() - security risk"
22 
23      - pattern: "\\$_GET|\\$_POST|\\$_REQUEST"
24        message: "Use Drupal's input sanitization methods"
25 
26      - pattern: "innerHTML"
27        message: "Use textContent or sanitize HTML content"
28 
29  - type: suggest
30    message: |
31      Security Best Practices:
32      - Implement CSRF protection
33      - Use prepared statements for queries
34      - Sanitize user input
35      - Implement proper access controls
36      - Follow security updates protocol
37      - Ensure Drupal file permissions are secure (see drupal-file-permissions.mdc)
38      - Use ahoy cli commands instead of direct docker compose exec
39 
40metadata:
41  priority: critical
42  version: 1.0
43</rule>