Cursor rule

1---
2description: Security, permissions, storage, and messaging rules for session-related extension logic
3globs: ["src/**/*.ts", "src/**/*.tsx", "src/**/*.js", "src/manifest*.json"]
4alwaysApply: false
5---
6 
7This project handles account and session switching, so security is a first-class concern.
8 
9Permissions and privacy:
10- Follow least-privilege permissions.
11- Never add broader permissions, host permissions, or site match patterns unless explicitly requested and justified.
12- Prefer optional or narrower permissions when possible.
13 
14Storage rules:
15- Minimize persisted sensitive data.
16- Assume extension storage is not a secure secret vault.
17- Do not store plaintext secrets, passwords, raw session cookies, or long-lived sensitive tokens unless explicitly required and discussed.
18- Keep the lifetime of session-related data as short as practical.
19- Remove temporary or session-related state on logout, removal, or invalidation paths when applicable.
20 
21Messaging and input safety:
22- Validate message payload shape and expected message types.
23- Do not trust content-script or UI input without validation.
24- Never log tokens, cookies, secrets, or personally identifiable data.
25- Avoid unsafe DOM patterns such as injecting untrusted HTML; prefer safe text rendering.
26 
27Review behavior:
28- For auth, session, storage, or permission changes, briefly explain:
29  1. what data is handled,
30  2. where it is stored,
31  3. how long it lives,
32  4. how it is cleared,
33  5. why the approach is safe enough for the current architecture.