Cursor rule

1---
2description: "Swift security extending common rules"
3globs: ["**/*.swift", "**/Package.swift"]
4alwaysApply: false
5---
6# Swift Security
7 
8> This file extends the common security rule with Swift specific content.
9 
10## Secret Management
11 
12- Use **Keychain Services** for sensitive data (tokens, passwords, keys) -- never `UserDefaults`
13- Use environment variables or `.xcconfig` files for build-time secrets
14- Never hardcode secrets in source -- decompilation tools extract them trivially
15 
16```swift
17let apiKey = ProcessInfo.processInfo.environment["API_KEY"]
18guard let apiKey, !apiKey.isEmpty else {
19    fatalError("API_KEY not configured")
20}
21```
22 
23## Transport Security
24 
25- App Transport Security (ATS) is enforced by default -- do not disable it
26- Use certificate pinning for critical endpoints
27- Validate all server certificates
28 
29## Input Validation
30 
31- Sanitize all user input before display to prevent injection
32- Use `URL(string:)` with validation rather than force-unwrapping
33- Validate data from external sources (APIs, deep links, pasteboard) before processing
34