| Dimension | Shared | Only in A | Only in B | Overlap |
|---|---|---|---|---|
| Sections | 1 | 11 | 7 | 5% |
| Commands | 0 | 0 | 3 | 0% |
| Section tags | 1 | 4 | 1 | 17% |
What each file covers
Sections
1 shared · 11 only in A · 7 only in B- − Cursor Agents Guide (Using Cursor Rules)
- − How To Use With Cursor
- − Installation Options
- − Rule Bundles (Source of Truth)
- − Core
- − Web Stack
- − Python
- − JavaScript Security
- − Tag-Based Selection
- − Maintainer Checklist
- − Updating Or Removing
- + Drupal Vulnerable and Outdated Components Standards (OWASP A06:2021)
- + Rule Details
- + Filters
- + Enforcement Checks
- + Suggestions
- + Validation Checks
- + Metadata
- References
Commands
0 shared · 0 only in A · 3 only in B- + composer\\.json
- + composer update --with-dependencies
- + composer outdated
Section tags
1 shared · 4 only in A · 1 only in B- − build
- − git-pr
- − do-not
- − agent-behaviour
- + code-style
- security
Line diff
ivangrynenko/cursorrules · AGENTS.md
@@ −1 @@
1# Cursor Agents Guide (Using Cursor Rules)
2
3This document explains how to use the rules in this repository with Cursor and serves as a single entry point that references the existing rule files. It avoids duplication by linking directly to the `.cursor/rules/*.mdc` sources.
4
5If you installed these rules via the installer, a project‑local AGENTS.md can be generated that lists only the rules you chose. By default, the installer writes AGENTS.md if absent; it overwrites only when you pass `--yes`.
6
7## How To Use With Cursor
8- Open your project in Cursor. Rules under `.cursor/rules` are discovered automatically by Cursor.
9- Keep this AGENTS.md handy as your quick index to the rule set.
10- For installation methods and advanced options, see `README.md`.
11
12## Installation Options
13For full installation details and examples, see `README.md`.
14- Core rules only: `--core`
15- Web stack (includes core): `--web-stack` or `--ws`
16- Python (includes core): `--python`
17- JavaScript security (includes core): `--javascript`
18- All rules: `--all`
19- Tag-based selection: `--tags "<expression>"` or `--tag-preset <name>`
20- Ignore files control: `--ignore-files yes|no|ask`
21
22Tag taxonomy is documented in `TAG_STANDARDS.md`.
23
24## Rule Bundles (Source of Truth)
25Below are the rule bundles and their rule files. Each item links directly to the authoritative file under `.cursor/rules/`.
26
27### Core
28- [.cursor/rules/cursor-rules.mdc](.cursor/rules/cursor-rules.mdc)
29- [.cursor/rules/git-commit-standards.mdc](.cursor/rules/git-commit-standards.mdc)
30- [.cursor/rules/github-actions-standards.mdc](.cursor/rules/github-actions-standards.mdc)
31- [.cursor/rules/improve-cursorrules-efficiency.mdc](.cursor/rules/improve-cursorrules-efficiency.mdc)
32- [.cursor/rules/pull-request-changelist-instructions.mdc](.cursor/rules/pull-request-changelist-instructions.mdc)
33- [.cursor/rules/readme-maintenance-standards.mdc](.cursor/rules/readme-maintenance-standards.mdc)
34- [.cursor/rules/testing-guidelines.mdc](.cursor/rules/testing-guidelines.mdc)
35 - [.cursor/rules/confluence-editing-standards.mdc](.cursor/rules/confluence-editing-standards.mdc)
36
37### Web Stack
38- [.cursor/rules/accessibility-standards.mdc](.cursor/rules/accessibility-standards.mdc)
39- [.cursor/rules/api-standards.mdc](.cursor/rules/api-standards.mdc)
40- [.cursor/rules/build-optimization.mdc](.cursor/rules/build-optimization.mdc)
41- [.cursor/rules/code-generation-standards.mdc](.cursor/rules/code-generation-standards.mdc)
42- [.cursor/rules/debugging-standards.mdc](.cursor/rules/debugging-standards.mdc)
43- [.cursor/rules/docker-compose-standards.mdc](.cursor/rules/docker-compose-standards.mdc)
44- [.cursor/rules/drupal-authentication-failures.mdc](.cursor/rules/drupal-authentication-failures.mdc)
45- [.cursor/rules/drupal-broken-access-control.mdc](.cursor/rules/drupal-broken-access-control.mdc)
46- [.cursor/rules/drupal-cryptographic-failures.mdc](.cursor/rules/drupal-cryptographic-failures.mdc)
47- [.cursor/rules/drupal-database-standards.mdc](.cursor/rules/drupal-database-standards.mdc)
48- [.cursor/rules/drupal-file-permissions.mdc](.cursor/rules/drupal-file-permissions.mdc)
49- [.cursor/rules/drupal-injection.mdc](.cursor/rules/drupal-injection.mdc)
50- [.cursor/rules/drupal-insecure-design.mdc](.cursor/rules/drupal-insecure-design.mdc)
51- [.cursor/rules/drupal-integrity-failures.mdc](.cursor/rules/drupal-integrity-failures.mdc)
52- [.cursor/rules/drupal-logging-failures.mdc](.cursor/rules/drupal-logging-failures.mdc)
53- [.cursor/rules/drupal-security-misconfiguration.mdc](.cursor/rules/drupal-security-misconfiguration.mdc)
54- [.cursor/rules/drupal-ssrf.mdc](.cursor/rules/drupal-ssrf.mdc)
55- [.cursor/rules/drupal-vulnerable-components.mdc](.cursor/rules/drupal-vulnerable-components.mdc)
56- [.cursor/rules/generic_bash_style.mdc](.cursor/rules/generic_bash_style.mdc)
57- [.cursor/rules/javascript-performance.mdc](.cursor/rules/javascript-performance.mdc)
58- [.cursor/rules/javascript-standards.mdc](.cursor/rules/javascript-standards.mdc)
59- [.cursor/rules/lagoon-docker-compose-standards.mdc](.cursor/rules/lagoon-docker-compose-standards.mdc)
60- [.cursor/rules/lagoon-yml-standards.mdc](.cursor/rules/lagoon-yml-standards.mdc)
61- [.cursor/rules/multi-agent-coordination.mdc](.cursor/rules/multi-agent-coordination.mdc)
62- [.cursor/rules/node-dependencies.mdc](.cursor/rules/node-dependencies.mdc)
63- [.cursor/rules/php-drupal-best-practices.mdc](.cursor/rules/php-drupal-best-practices.mdc)
64- [.cursor/rules/php-drupal-development-standards.mdc](.cursor/rules/php-drupal-development-standards.mdc)
65- [.cursor/rules/php-memory-optimisation.mdc](.cursor/rules/php-memory-optimisation.mdc)
66- [.cursor/rules/project-definition-template.mdc](.cursor/rules/project-definition-template.mdc)
67- [.cursor/rules/react-patterns.mdc](.cursor/rules/react-patterns.mdc)
68- [.cursor/rules/security-practices.mdc](.cursor/rules/security-practices.mdc)
69- [.cursor/rules/secret-detection.mdc](.cursor/rules/secret-detection.mdc)
70- [.cursor/rules/tailwind-standards.mdc](.cursor/rules/tailwind-standards.mdc)
71- [.cursor/rules/tests-documentation-maintenance.mdc](.cursor/rules/tests-documentation-maintenance.mdc)
72- [.cursor/rules/third-party-integration.mdc](.cursor/rules/third-party-integration.mdc)
73- [.cursor/rules/vortex-cicd-standards.mdc](.cursor/rules/vortex-cicd-standards.mdc)
74- [.cursor/rules/vortex-scaffold-standards.mdc](.cursor/rules/vortex-scaffold-standards.mdc)
75- [.cursor/rules/vue-best-practices.mdc](.cursor/rules/vue-best-practices.mdc)
76- [.cursor/rules/behat-steps.mdc](.cursor/rules/behat-steps.mdc)
77- [.cursor/rules/behat-ai-guide.mdc](.cursor/rules/behat-ai-guide.mdc)
78
79### Python
80- [.cursor/rules/python-authentication-failures.mdc](.cursor/rules/python-authentication-failures.mdc)
81- [.cursor/rules/python-broken-access-control.mdc](.cursor/rules/python-broken-access-control.mdc)
82- [.cursor/rules/python-cryptographic-failures.mdc](.cursor/rules/python-cryptographic-failures.mdc)
83- [.cursor/rules/python-injection.mdc](.cursor/rules/python-injection.mdc)
84- [.cursor/rules/python-insecure-design.mdc](.cursor/rules/python-insecure-design.mdc)
85- [.cursor/rules/python-integrity-failures.mdc](.cursor/rules/python-integrity-failures.mdc)
86- [.cursor/rules/python-logging-monitoring-failures.mdc](.cursor/rules/python-logging-monitoring-failures.mdc)
87- [.cursor/rules/python-security-misconfiguration.mdc](.cursor/rules/python-security-misconfiguration.mdc)
88- [.cursor/rules/python-ssrf.mdc](.cursor/rules/python-ssrf.mdc)
89- [.cursor/rules/python-vulnerable-outdated-components.mdc](.cursor/rules/python-vulnerable-outdated-components.mdc)
90- [.cursor/rules/security-practices.mdc](.cursor/rules/security-practices.mdc)
91
92### JavaScript Security
93- [.cursor/rules/javascript-broken-access-control.mdc](.cursor/rules/javascript-broken-access-control.mdc)
94- [.cursor/rules/javascript-cryptographic-failures.mdc](.cursor/rules/javascript-cryptographic-failures.mdc)
95- [.cursor/rules/javascript-identification-authentication-failures.mdc](.cursor/rules/javascript-identification-authentication-failures.mdc)
96- [.cursor/rules/javascript-injection.mdc](.cursor/rules/javascript-injection.mdc)
97- [.cursor/rules/javascript-insecure-design.mdc](.cursor/rules/javascript-insecure-design.mdc)
98- [.cursor/rules/javascript-security-logging-monitoring-failures.mdc](.cursor/rules/javascript-security-logging-monitoring-failures.mdc)
99- [.cursor/rules/javascript-security-misconfiguration.mdc](.cursor/rules/javascript-security-misconfiguration.mdc)
100- [.cursor/rules/javascript-server-side-request-forgery.mdc](.cursor/rules/javascript-server-side-request-forgery.mdc)
101- [.cursor/rules/javascript-software-data-integrity-failures.mdc](.cursor/rules/javascript-software-data-integrity-failures.mdc)
102- [.cursor/rules/javascript-vulnerable-outdated-components.mdc](.cursor/rules/javascript-vulnerable-outdated-components.mdc)
103
104## Tag-Based Selection
105The installer supports tag expressions and presets. Examples:
106- `--tags "language:javascript category:security"`
107- `--tags "framework:react"`
108- `--tags "language:php standard:owasp-top10"`
109- `--tag-preset js-owasp`
110
111See `TAG_STANDARDS.md` for the complete tag taxonomy and guidance.
112
113## Maintainer Checklist
114- Before opening a pull request, prepend a new entry to `CHANGELOG.md` describing your changes (latest release first) and never delete prior history.
115- Ensure the summary in `CHANGELOG.md` matches the work being done and that `CURSOR_RULES_VERSION` reflects the next release number.
116- Record key implementation notes in this `AGENTS.md` only when they affect installer behaviour or rule coverage so the instructions stay current.
117- Regenerate project-local `AGENTS.md` files with `--yes` when you need to refresh them after significant rule or command updates.
118
119## Updating Or Removing
120- To update, re-run the installer with your preferred options (it will copy over updated rules). See `README.md`.
121- To remove rules, delete files from `.cursor/rules` and remove any generated `.cursorignore` files if not needed.
122
123## References
124- Project README: [README.md](README.md)
125- Tag standards: [TAG_STANDARDS.md](TAG_STANDARDS.md)
126- All rule sources: `.cursor/rules/*.mdc`
127
ivangrynenko/cursorrules · .cursor/rules/drupal-vulnerable-components.mdc
@@ +1 @@
1---
2description: Detect and prevent vulnerabilities related to outdated or vulnerable components in Drupal as defined in OWASP Top 10:2021-A06
3globs: *.php, *.install, *.module, *.inc, *.theme, *.yml, *.info
4alwaysApply: false
5---
6# Drupal Vulnerable and Outdated Components Standards (OWASP A06:2021)
7
8This rule enforces security best practices to prevent vulnerabilities related to outdated or vulnerable components in Drupal applications, as defined in OWASP Top 10:2021-A06.
9
10## Rule Details
11
12- **Name:** drupal_vulnerable_components
13
14- **Description:** Detect and prevent vulnerabilities related to outdated or vulnerable components in Drupal as defined in OWASP Top 10:2021-A06
15
16## Filters
17- file extension pattern: `\\.(php|inc|module|install|info\\.yml|json)$`
18- file path pattern: `.*`
19
20## Enforcement Checks
21- Conditions:
22 - pattern `core:\\s*('|\")8\\.[0-6](mdc:'|\")|core_version_requirement:\\s*('|\")[^9].+('|\")` – Potentially outdated Drupal core version detected. Consider upgrading to the latest secure version of Drupal 9 or 10.
23 - Pattern 1: Outdated Drupal core version declaration
24 - pattern `drupal_set_message\\(|format_date\\(|drupal_render\\(|entity_load\\(|variable_get\\(|variable_set\\(` – Deprecated function detected. Use modern replacements to ensure compatibility and security updates.
25 - Pattern 2: Usage of deprecated functions
26 - pattern `jquery\\.min\\.js\\?v=1\\.|jquery-1\\.|jquery-2\\.|ckeditor/|tinymce/|angular\\.js@1\\.` – Potentially vulnerable JavaScript library version detected. Update to the latest secure version.
27 - Pattern 3: Known vulnerable libraries referenced
28 - pattern `<script\\s+src=['\"]http|<script\\s+src=['\"]//|<link\\s+[^>]*href=['\"]http` – External scripts or stylesheets without Subresource Integrity (SRI) checks detected. Add integrity and crossorigin attributes.
29 - Pattern 4: Direct inclusion of external scripts without SRI
30 - pattern `module:\\s*('[^']*captcha'|'recaptcha'|'xmlrpc'|'openid'|'php')` – Potentially vulnerable or deprecated module detected. Consider using more secure alternatives.
31 - Pattern 5: Use of obsolete or removed modules
32 - pattern `\"drupal/[^\"]+\":\\s*\"(~|\\^)?[0-9]\\.[0-9]\\.[0-9]\"` – Hard-coded specific version detected in composer.json. Consider using version ranges to receive security updates.
33 - Pattern 6: Hard-coded versions in composer.json
34 - pattern `mysql_|split\\(|ereg\\(|eregi\\(|create_function\\(|each\\(` – Deprecated or insecure PHP function detected. Use modern alternatives for better security.
35 - Pattern 7: Outdated or insecure PHP API usage
36 - pattern `type:\\s*module\\s*\\nname:` – Ensure your module specifies core_version_requirement to prevent installation on unsupported Drupal versions.
37 - Pattern 8: Usage of contrib modules without version constraints
38 - pattern `composer\\.json` – Consider adding drupal/core-security-advisories as a dev dependency to detect known vulnerable packages.
39 - Pattern 9: Missing security advisories handling in composer.json
40 - pattern `check_plain\\(|filter_xss\\(|filter_xss_admin\\(` – Legacy text sanitization function detected. Use Html::escape() or Xss::filter() instead.
41 - Pattern 10: Direct usage of vulnerable sanitization functions
42
43## Suggestions
44- Guidance:
45**Drupal Component Security Best Practices:**
46
471. **Update Management:**
48 - Keep Drupal core updated to the latest secure version
49 - Subscribe to the Drupal Security Newsletter
50 - Implement a regular update schedule (monthly at minimum)
51 - Use security advisories checking in your development workflow
52 - Implement Composer's security-advisories metadata
53
542. **Dependency Management:**
55 - Use Composer for managing all dependencies
56 - Specify version constraints that allow security updates
57 - Add drupal/core-security-advisories as a dev dependency
58 - Regularly run `composer update --with-dependencies`
59 - Use `composer outdated` to identify outdated packages
60
613. **API Usage:**
62 - Use modern Drupal APIs rather than deprecated functions
63 - Migrate away from jQuery to modern JavaScript where possible
64 - Implement Subresource Integrity (SRI) for external resources
65 - Update custom code to use current best practices
66 - Follow the Drupal API deprecation policies
67
684. **Security Monitoring:**
69 - Implement automated vulnerability scanning in CI/CD
70 - Use tools like Drupal Check or Upgrade Status module
71 - Monitor the Drupal security advisories page
72 - Implement automated updates for non-critical dependencies
73 - Set up alerts for security issues in used components
74
755. **Module Management:**
76 - Remove unused modules from your codebase
77 - Prefer well-maintained modules with security teams
78 - Implement proper version constraints in module info files
79 - Consider the security impact before adding new dependencies
80 - Document your dependency management practices
81
82## Validation Checks
83- Conditions:
84 - pattern `core_version_requirement:\\s*[\"']\\^(8\\.8|8\\.9|9|10)\\.[0-9]+[\"']` – Using proper core version requirements.
85 - Check 1: Proper core version requirement
86 - pattern `\\\\Drupal::messenger\\(\\)|->messenger\\(\\)|\\\\Drupal::service\\('messenger'\\)` – Using modern message API instead of deprecated functions.
87 - Check 2: Use of modern APIs
88 - pattern `\"require\":\\s*\\{[^}]*\"drupal/core(-recommended)?\":\\s*\"\\^[0-9]+\\.[0-9]+\"` – Using proper version constraints in Composer.
89 - Check 3: Proper composer usage
90 - pattern `integrity=[\"'][a-zA-Z0-9\\+/=\\-_]+[\"']\\s+crossorigin=[\"']anonymous[\"']` – Properly implementing Subresource Integrity.
91 - Check 4: SRI implementation
92
93## Metadata
94- Priority: high
95- Version: 1.1
96- Tags: security, drupal, dependencies, vulnerable-components, owasp, language:php, framework:drupal, category:security, subcategory:dependencies, standard:owasp-top10, risk:a06-vulnerable-components
97## References
98- https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/
99- https://www.drupal.org/docs/security-in-drupal/staying-up-to-date
100- https://www.drupal.org/docs/upgrading-drupal
101- https://www.drupal.org/docs/develop/using-composer/managing-dependencies-for-a-drupal-project
102
103
@@ −1 +1 @@
1−# Cursor Agents Guide (Using Cursor Rules)
1+---
2+description: Detect and prevent vulnerabilities related to outdated or vulnerable components in Drupal as defined in OWASP Top 10:2021-A06
3+globs: *.php, *.install, *.module, *.inc, *.theme, *.yml, *.info
4+alwaysApply: false
5+---
6+# Drupal Vulnerable and Outdated Components Standards (OWASP A06:2021)
27
3−This document explains how to use the rules in this repository with Cursor and serves as a single entry point that references the existing rule files. It avoids duplication by linking directly to the `.cursor/rules/*.mdc` sources.
8+This rule enforces security best practices to prevent vulnerabilities related to outdated or vulnerable components in Drupal applications, as defined in OWASP Top 10:2021-A06.
49
5−If you installed these rules via the installer, a project‑local AGENTS.md can be generated that lists only the rules you chose. By default, the installer writes AGENTS.md if absent; it overwrites only when you pass `--yes`.
10+## Rule Details
611
7−## How To Use With Cursor
8−- Open your project in Cursor. Rules under `.cursor/rules` are discovered automatically by Cursor.
9−- Keep this AGENTS.md handy as your quick index to the rule set.
10−- For installation methods and advanced options, see `README.md`.
12+- **Name:** drupal_vulnerable_components
1113
12−## Installation Options
13−For full installation details and examples, see `README.md`.
14−- Core rules only: `--core`
15−- Web stack (includes core): `--web-stack` or `--ws`
16−- Python (includes core): `--python`
17−- JavaScript security (includes core): `--javascript`
18−- All rules: `--all`
19−- Tag-based selection: `--tags "<expression>"` or `--tag-preset <name>`
20−- Ignore files control: `--ignore-files yes|no|ask`
14+- **Description:** Detect and prevent vulnerabilities related to outdated or vulnerable components in Drupal as defined in OWASP Top 10:2021-A06
2115
22−Tag taxonomy is documented in `TAG_STANDARDS.md`.
16+## Filters
17+- file extension pattern: `\\.(php|inc|module|install|info\\.yml|json)$`
18+- file path pattern: `.*`
2319
24−## Rule Bundles (Source of Truth)
25−Below are the rule bundles and their rule files. Each item links directly to the authoritative file under `.cursor/rules/`.
20+## Enforcement Checks
21+- Conditions:
22+ - pattern `core:\\s*('|\")8\\.[0-6](mdc:'|\")|core_version_requirement:\\s*('|\")[^9].+('|\")` – Potentially outdated Drupal core version detected. Consider upgrading to the latest secure version of Drupal 9 or 10.
23+ - Pattern 1: Outdated Drupal core version declaration
24+ - pattern `drupal_set_message\\(|format_date\\(|drupal_render\\(|entity_load\\(|variable_get\\(|variable_set\\(` – Deprecated function detected. Use modern replacements to ensure compatibility and security updates.
25+ - Pattern 2: Usage of deprecated functions
26+ - pattern `jquery\\.min\\.js\\?v=1\\.|jquery-1\\.|jquery-2\\.|ckeditor/|tinymce/|angular\\.js@1\\.` – Potentially vulnerable JavaScript library version detected. Update to the latest secure version.
27+ - Pattern 3: Known vulnerable libraries referenced
28+ - pattern `<script\\s+src=['\"]http|<script\\s+src=['\"]//|<link\\s+[^>]*href=['\"]http` – External scripts or stylesheets without Subresource Integrity (SRI) checks detected. Add integrity and crossorigin attributes.
29+ - Pattern 4: Direct inclusion of external scripts without SRI
30+ - pattern `module:\\s*('[^']*captcha'|'recaptcha'|'xmlrpc'|'openid'|'php')` – Potentially vulnerable or deprecated module detected. Consider using more secure alternatives.
31+ - Pattern 5: Use of obsolete or removed modules
32+ - pattern `\"drupal/[^\"]+\":\\s*\"(~|\\^)?[0-9]\\.[0-9]\\.[0-9]\"` – Hard-coded specific version detected in composer.json. Consider using version ranges to receive security updates.
33+ - Pattern 6: Hard-coded versions in composer.json
34+ - pattern `mysql_|split\\(|ereg\\(|eregi\\(|create_function\\(|each\\(` – Deprecated or insecure PHP function detected. Use modern alternatives for better security.
35+ - Pattern 7: Outdated or insecure PHP API usage
36+ - pattern `type:\\s*module\\s*\\nname:` – Ensure your module specifies core_version_requirement to prevent installation on unsupported Drupal versions.
37+ - Pattern 8: Usage of contrib modules without version constraints
38+ - pattern `composer\\.json` – Consider adding drupal/core-security-advisories as a dev dependency to detect known vulnerable packages.
39+ - Pattern 9: Missing security advisories handling in composer.json
40+ - pattern `check_plain\\(|filter_xss\\(|filter_xss_admin\\(` – Legacy text sanitization function detected. Use Html::escape() or Xss::filter() instead.
41+ - Pattern 10: Direct usage of vulnerable sanitization functions
2642
27−### Core
28−- [.cursor/rules/cursor-rules.mdc](.cursor/rules/cursor-rules.mdc)
29−- [.cursor/rules/git-commit-standards.mdc](.cursor/rules/git-commit-standards.mdc)
30−- [.cursor/rules/github-actions-standards.mdc](.cursor/rules/github-actions-standards.mdc)
31−- [.cursor/rules/improve-cursorrules-efficiency.mdc](.cursor/rules/improve-cursorrules-efficiency.mdc)
32−- [.cursor/rules/pull-request-changelist-instructions.mdc](.cursor/rules/pull-request-changelist-instructions.mdc)
33−- [.cursor/rules/readme-maintenance-standards.mdc](.cursor/rules/readme-maintenance-standards.mdc)
34−- [.cursor/rules/testing-guidelines.mdc](.cursor/rules/testing-guidelines.mdc)
35− - [.cursor/rules/confluence-editing-standards.mdc](.cursor/rules/confluence-editing-standards.mdc)
43+## Suggestions
44+- Guidance:
45+**Drupal Component Security Best Practices:**
3646
37−### Web Stack
38−- [.cursor/rules/accessibility-standards.mdc](.cursor/rules/accessibility-standards.mdc)
39−- [.cursor/rules/api-standards.mdc](.cursor/rules/api-standards.mdc)
40−- [.cursor/rules/build-optimization.mdc](.cursor/rules/build-optimization.mdc)
41−- [.cursor/rules/code-generation-standards.mdc](.cursor/rules/code-generation-standards.mdc)
42−- [.cursor/rules/debugging-standards.mdc](.cursor/rules/debugging-standards.mdc)
43−- [.cursor/rules/docker-compose-standards.mdc](.cursor/rules/docker-compose-standards.mdc)
44−- [.cursor/rules/drupal-authentication-failures.mdc](.cursor/rules/drupal-authentication-failures.mdc)
45−- [.cursor/rules/drupal-broken-access-control.mdc](.cursor/rules/drupal-broken-access-control.mdc)
46−- [.cursor/rules/drupal-cryptographic-failures.mdc](.cursor/rules/drupal-cryptographic-failures.mdc)
47−- [.cursor/rules/drupal-database-standards.mdc](.cursor/rules/drupal-database-standards.mdc)
48−- [.cursor/rules/drupal-file-permissions.mdc](.cursor/rules/drupal-file-permissions.mdc)
49−- [.cursor/rules/drupal-injection.mdc](.cursor/rules/drupal-injection.mdc)
50−- [.cursor/rules/drupal-insecure-design.mdc](.cursor/rules/drupal-insecure-design.mdc)
51−- [.cursor/rules/drupal-integrity-failures.mdc](.cursor/rules/drupal-integrity-failures.mdc)
52−- [.cursor/rules/drupal-logging-failures.mdc](.cursor/rules/drupal-logging-failures.mdc)
53−- [.cursor/rules/drupal-security-misconfiguration.mdc](.cursor/rules/drupal-security-misconfiguration.mdc)
54−- [.cursor/rules/drupal-ssrf.mdc](.cursor/rules/drupal-ssrf.mdc)
55−- [.cursor/rules/drupal-vulnerable-components.mdc](.cursor/rules/drupal-vulnerable-components.mdc)
56−- [.cursor/rules/generic_bash_style.mdc](.cursor/rules/generic_bash_style.mdc)
57−- [.cursor/rules/javascript-performance.mdc](.cursor/rules/javascript-performance.mdc)
58−- [.cursor/rules/javascript-standards.mdc](.cursor/rules/javascript-standards.mdc)
59−- [.cursor/rules/lagoon-docker-compose-standards.mdc](.cursor/rules/lagoon-docker-compose-standards.mdc)
60−- [.cursor/rules/lagoon-yml-standards.mdc](.cursor/rules/lagoon-yml-standards.mdc)
61−- [.cursor/rules/multi-agent-coordination.mdc](.cursor/rules/multi-agent-coordination.mdc)
62−- [.cursor/rules/node-dependencies.mdc](.cursor/rules/node-dependencies.mdc)
63−- [.cursor/rules/php-drupal-best-practices.mdc](.cursor/rules/php-drupal-best-practices.mdc)
64−- [.cursor/rules/php-drupal-development-standards.mdc](.cursor/rules/php-drupal-development-standards.mdc)
65−- [.cursor/rules/php-memory-optimisation.mdc](.cursor/rules/php-memory-optimisation.mdc)
66−- [.cursor/rules/project-definition-template.mdc](.cursor/rules/project-definition-template.mdc)
67−- [.cursor/rules/react-patterns.mdc](.cursor/rules/react-patterns.mdc)
68−- [.cursor/rules/security-practices.mdc](.cursor/rules/security-practices.mdc)
69−- [.cursor/rules/secret-detection.mdc](.cursor/rules/secret-detection.mdc)
70−- [.cursor/rules/tailwind-standards.mdc](.cursor/rules/tailwind-standards.mdc)
71−- [.cursor/rules/tests-documentation-maintenance.mdc](.cursor/rules/tests-documentation-maintenance.mdc)
72−- [.cursor/rules/third-party-integration.mdc](.cursor/rules/third-party-integration.mdc)
73−- [.cursor/rules/vortex-cicd-standards.mdc](.cursor/rules/vortex-cicd-standards.mdc)
74−- [.cursor/rules/vortex-scaffold-standards.mdc](.cursor/rules/vortex-scaffold-standards.mdc)
75−- [.cursor/rules/vue-best-practices.mdc](.cursor/rules/vue-best-practices.mdc)
76−- [.cursor/rules/behat-steps.mdc](.cursor/rules/behat-steps.mdc)
77−- [.cursor/rules/behat-ai-guide.mdc](.cursor/rules/behat-ai-guide.mdc)
47+1. **Update Management:**
48+ - Keep Drupal core updated to the latest secure version
49+ - Subscribe to the Drupal Security Newsletter
50+ - Implement a regular update schedule (monthly at minimum)
51+ - Use security advisories checking in your development workflow
52+ - Implement Composer's security-advisories metadata
7853
79−### Python
80−- [.cursor/rules/python-authentication-failures.mdc](.cursor/rules/python-authentication-failures.mdc)
81−- [.cursor/rules/python-broken-access-control.mdc](.cursor/rules/python-broken-access-control.mdc)
82−- [.cursor/rules/python-cryptographic-failures.mdc](.cursor/rules/python-cryptographic-failures.mdc)
83−- [.cursor/rules/python-injection.mdc](.cursor/rules/python-injection.mdc)
84−- [.cursor/rules/python-insecure-design.mdc](.cursor/rules/python-insecure-design.mdc)
85−- [.cursor/rules/python-integrity-failures.mdc](.cursor/rules/python-integrity-failures.mdc)
86−- [.cursor/rules/python-logging-monitoring-failures.mdc](.cursor/rules/python-logging-monitoring-failures.mdc)
87−- [.cursor/rules/python-security-misconfiguration.mdc](.cursor/rules/python-security-misconfiguration.mdc)
88−- [.cursor/rules/python-ssrf.mdc](.cursor/rules/python-ssrf.mdc)
89−- [.cursor/rules/python-vulnerable-outdated-components.mdc](.cursor/rules/python-vulnerable-outdated-components.mdc)
90−- [.cursor/rules/security-practices.mdc](.cursor/rules/security-practices.mdc)
54+2. **Dependency Management:**
55+ - Use Composer for managing all dependencies
56+ - Specify version constraints that allow security updates
57+ - Add drupal/core-security-advisories as a dev dependency
58+ - Regularly run `composer update --with-dependencies`
59+ - Use `composer outdated` to identify outdated packages
9160
92−### JavaScript Security
93−- [.cursor/rules/javascript-broken-access-control.mdc](.cursor/rules/javascript-broken-access-control.mdc)
94−- [.cursor/rules/javascript-cryptographic-failures.mdc](.cursor/rules/javascript-cryptographic-failures.mdc)
95−- [.cursor/rules/javascript-identification-authentication-failures.mdc](.cursor/rules/javascript-identification-authentication-failures.mdc)
96−- [.cursor/rules/javascript-injection.mdc](.cursor/rules/javascript-injection.mdc)
97−- [.cursor/rules/javascript-insecure-design.mdc](.cursor/rules/javascript-insecure-design.mdc)
98−- [.cursor/rules/javascript-security-logging-monitoring-failures.mdc](.cursor/rules/javascript-security-logging-monitoring-failures.mdc)
99−- [.cursor/rules/javascript-security-misconfiguration.mdc](.cursor/rules/javascript-security-misconfiguration.mdc)
100−- [.cursor/rules/javascript-server-side-request-forgery.mdc](.cursor/rules/javascript-server-side-request-forgery.mdc)
101−- [.cursor/rules/javascript-software-data-integrity-failures.mdc](.cursor/rules/javascript-software-data-integrity-failures.mdc)
102−- [.cursor/rules/javascript-vulnerable-outdated-components.mdc](.cursor/rules/javascript-vulnerable-outdated-components.mdc)
61+3. **API Usage:**
62+ - Use modern Drupal APIs rather than deprecated functions
63+ - Migrate away from jQuery to modern JavaScript where possible
64+ - Implement Subresource Integrity (SRI) for external resources
65+ - Update custom code to use current best practices
66+ - Follow the Drupal API deprecation policies
10367
104−## Tag-Based Selection
105−The installer supports tag expressions and presets. Examples:
106−- `--tags "language:javascript category:security"`
107−- `--tags "framework:react"`
108−- `--tags "language:php standard:owasp-top10"`
109−- `--tag-preset js-owasp`
68+4. **Security Monitoring:**
69+ - Implement automated vulnerability scanning in CI/CD
70+ - Use tools like Drupal Check or Upgrade Status module
71+ - Monitor the Drupal security advisories page
72+ - Implement automated updates for non-critical dependencies
73+ - Set up alerts for security issues in used components
11074
111−See `TAG_STANDARDS.md` for the complete tag taxonomy and guidance.
75+5. **Module Management:**
76+ - Remove unused modules from your codebase
77+ - Prefer well-maintained modules with security teams
78+ - Implement proper version constraints in module info files
79+ - Consider the security impact before adding new dependencies
80+ - Document your dependency management practices
11281
113−## Maintainer Checklist
114−- Before opening a pull request, prepend a new entry to `CHANGELOG.md` describing your changes (latest release first) and never delete prior history.
115−- Ensure the summary in `CHANGELOG.md` matches the work being done and that `CURSOR_RULES_VERSION` reflects the next release number.
116−- Record key implementation notes in this `AGENTS.md` only when they affect installer behaviour or rule coverage so the instructions stay current.
117−- Regenerate project-local `AGENTS.md` files with `--yes` when you need to refresh them after significant rule or command updates.
82+## Validation Checks
83+- Conditions:
84+ - pattern `core_version_requirement:\\s*[\"']\\^(8\\.8|8\\.9|9|10)\\.[0-9]+[\"']` – Using proper core version requirements.
85+ - Check 1: Proper core version requirement
86+ - pattern `\\\\Drupal::messenger\\(\\)|->messenger\\(\\)|\\\\Drupal::service\\('messenger'\\)` – Using modern message API instead of deprecated functions.
87+ - Check 2: Use of modern APIs
88+ - pattern `\"require\":\\s*\\{[^}]*\"drupal/core(-recommended)?\":\\s*\"\\^[0-9]+\\.[0-9]+\"` – Using proper version constraints in Composer.
89+ - Check 3: Proper composer usage
90+ - pattern `integrity=[\"'][a-zA-Z0-9\\+/=\\-_]+[\"']\\s+crossorigin=[\"']anonymous[\"']` – Properly implementing Subresource Integrity.
91+ - Check 4: SRI implementation
11892
119−## Updating Or Removing
120−- To update, re-run the installer with your preferred options (it will copy over updated rules). See `README.md`.
121−- To remove rules, delete files from `.cursor/rules` and remove any generated `.cursorignore` files if not needed.
122−
93+## Metadata
94+- Priority: high
95+- Version: 1.1
96+- Tags: security, drupal, dependencies, vulnerable-components, owasp, language:php, framework:drupal, category:security, subcategory:dependencies, standard:owasp-top10, risk:a06-vulnerable-components
12397 ## References
124−- Project README: [README.md](README.md)
125−- Tag standards: [TAG_STANDARDS.md](TAG_STANDARDS.md)
126−- All rule sources: `.cursor/rules/*.mdc`
98+- https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/
99+- https://www.drupal.org/docs/security-in-drupal/staying-up-to-date
100+- https://www.drupal.org/docs/upgrading-drupal
101+- https://www.drupal.org/docs/develop/using-composer/managing-dependencies-for-a-drupal-project
127102
103+
