Cursor rule

1---
2paths:
3  - "**/*.cs"
4  - "**/*.csx"
5  - "**/*.csproj"
6  - "**/appsettings*.json"
7---
8# C# Security
9 
10> This file extends [common/security.md](../common/security.md) with C#-specific content.
11 
12## Secret Management
13 
14- Never hardcode API keys, tokens, or connection strings in source code
15- Use environment variables, user secrets for local development, and a secret manager in production
16- Keep `appsettings.*.json` free of real credentials
17 
18```csharp
19// BAD
20const string ApiKey = "sk-live-123";
21 
22// GOOD
23var apiKey = builder.Configuration["OpenAI:ApiKey"]
24    ?? throw new InvalidOperationException("OpenAI:ApiKey is not configured.");
25```
26 
27## SQL Injection Prevention
28 
29- Always use parameterized queries with ADO.NET, Dapper, or EF Core
30- Never concatenate user input into SQL strings
31- Validate sort fields and filter operators before using dynamic query composition
32 
33```csharp
34const string sql = "SELECT * FROM Orders WHERE CustomerId = @customerId";
35await connection.QueryAsync<Order>(sql, new { customerId });
36```
37 
38## Input Validation
39 
40- Validate DTOs at the application boundary
41- Use data annotations, FluentValidation, or explicit guard clauses
42- Reject invalid model state before running business logic
43 
44## Authentication and Authorization
45 
46- Prefer framework auth handlers instead of custom token parsing
47- Enforce authorization policies at endpoint or handler boundaries
48- Never log raw tokens, passwords, or PII
49 
50## Error Handling
51 
52- Return safe client-facing messages
53- Log detailed exceptions with structured context server-side
54- Do not expose stack traces, SQL text, or filesystem paths in API responses
55 
56## References
57 
58See skill: `security-review` for broader application security review checklists.
59