Cursor rule

1---
2description: "PHP security extending common rules"
3globs: ["**/*.php", "**/composer.lock", "**/composer.json"]
4alwaysApply: false
5---
6# PHP Security
7 
8> This file extends the common security rule with PHP specific content.
9 
10## Database Safety
11 
12- Use prepared statements (`PDO`, Doctrine, Eloquent query builder) for all dynamic queries.
13- Scope ORM mass-assignment carefully and whitelist writable fields.
14 
15## Secrets and Dependencies
16 
17- Load secrets from environment variables or a secret manager, never from committed config files.
18- Run `composer audit` in CI and review package trust before adding dependencies.
19 
20## Auth and Session Safety
21 
22- Use `password_hash()` / `password_verify()` for password storage.
23- Regenerate session identifiers after authentication and privilege changes.
24- Enforce CSRF protection on state-changing web requests.
25