Cursor rule

1---
2description: "Kotlin security extending common rules"
3globs: ["**/*.kt", "**/*.kts", "**/build.gradle.kts"]
4alwaysApply: false
5---
6# Kotlin Security
7 
8> This file extends the common security rule with Kotlin-specific content.
9 
10## Secret Management
11 
12```kotlin
13val apiKey = System.getenv("API_KEY")
14    ?: throw IllegalStateException("API_KEY not configured")
15```
16 
17## SQL Injection Prevention
18 
19Always use Exposed's parameterized queries:
20 
21```kotlin
22// Good: Parameterized via Exposed DSL
23UsersTable.selectAll().where { UsersTable.email eq email }
24 
25// Bad: String interpolation in raw SQL
26exec("SELECT * FROM users WHERE email = '$email'")
27```
28 
29## Authentication
30 
31Use Ktor's Auth plugin with JWT:
32 
33```kotlin
34install(Authentication) {
35    jwt("jwt") {
36        verifier(
37            JWT.require(Algorithm.HMAC256(secret))
38                .withAudience(audience)
39                .withIssuer(issuer)
40                .build()
41        )
42        validate { credential ->
43            val payload = credential.payload
44            if (payload.audience.contains(audience) &&
45                payload.issuer == issuer &&
46                payload.subject != null) {
47                JWTPrincipal(payload)
48            } else {
49                null
50            }
51        }
52    }
53}
54```
55 
56## Null Safety as Security
57 
58Kotlin's type system prevents null-related vulnerabilities -- avoid `!!` to maintain this guarantee.
59