{"owner":"ColorlibHQ","repo":"SECURITY","hasSkills":true,"totalSkillsCount":1,"totalTokensCount":534,"categories":["cursor-rule"],"hasMcp":false,"mcpConfig":null,"found":[".cursorrules (security-devsecops-ssdls-appsec.mdc)"],"skills":{".cursorrules (security-devsecops-ssdls-appsec.mdc)":"# DevSecOps + SSDLC + AppSec Cursor Rule\n\n## General Security Principles\n- Never hardcode secrets, credentials, or API keys. Use environment variables or secure vaults for sensitive data.\n- Prohibit the inclusion of `.env`, secret config files, or unknown tokens in source control.\n- Never log sensitive data, secrets, or session tokens in application logs.\n- Validate and sanitize all user input. Escape output in HTML, JS, and SQL contexts.\n- Avoid unsafe functions such as `exec`, `eval`, or similar dynamic code execution.\n\n## Database Security\n- Use parameterized queries or ORM for all database access. Do not use string concatenation for query building.\n- Ensure database users have the least privilege required for their tasks.\n- Regularly review and update database access policies.\n\n## Dependency Management\n- Only use packages from verified sources.\n- Do not add new dependencies without explicit approval and security review.\n- Regularly update dependencies and scan for known vulnerabilities (SCA).\n\n## Authentication & Authorization\n- Use secure authentication frameworks; never implement custom authentication.\n- Store passwords using strong, salted hashes (e.g., Argon2, bcrypt).\n- Implement Role-Based Access Control (RBAC) for sensitive operations.\n- Enforce the principle of least privilege for APIs and UI actions.\n\n## Secure SDLC Practices\n- Integrate Static Application Security Testing (SAST) and Software Composition Analysis (SCA) into the CI pipeline.\n- Scan all code for secrets before merging (Secret Scanning).\n- Use Infrastructure as Code (IaC) scanning for all infrastructure code.\n- Integrate Dynamic Application Security Testing (DAST) in the CD pipeline for deployed applications.\n- Enforce Policy as Code (PaC) for automated, version-controlled security policies.\n\n## Monitoring & Feedback\n- Enable continuous vulnerability monitoring and alerting.\n- Integrate Runtime Application Self-Protection (RASP) and Web Application Firewall (WAF) as appropriate.\n- Encourage regular vulnerability assessments and penetration testing.\n- Maintain a feedback loop to update rules and prompts based on recurring vulnerabilities.\n\n## Compliance & Documentation\n- Align with industry standards (e.g., OWASP Top 10, NIST, ISO 27001).\n- Document all security controls and decisions for auditability."},"files":{".cursorrules (security-devsecops-ssdls-appsec.mdc)":"# DevSecOps + SSDLC + AppSec Cursor Rule\n\n## General Security Principles\n- Never hardcode secrets, credentials, or API keys. Use environment variables or secure vaults for sensitive data.\n- Prohibit the inclusion of `.env`, secret config files, or unknown tokens in source control.\n- Never log sensitive data, secrets, or session tokens in application logs.\n- Validate and sanitize all user input. Escape output in HTML, JS, and SQL contexts.\n- Avoid unsafe functions such as `exec`, `eval`, or similar dynamic code execution.\n\n## Database Security\n- Use parameterized queries or ORM for all database access. Do not use string concatenation for query building.\n- Ensure database users have the least privilege required for their tasks.\n- Regularly review and update database access policies.\n\n## Dependency Management\n- Only use packages from verified sources.\n- Do not add new dependencies without explicit approval and security review.\n- Regularly update dependencies and scan for known vulnerabilities (SCA).\n\n## Authentication & Authorization\n- Use secure authentication frameworks; never implement custom authentication.\n- Store passwords using strong, salted hashes (e.g., Argon2, bcrypt).\n- Implement Role-Based Access Control (RBAC) for sensitive operations.\n- Enforce the principle of least privilege for APIs and UI actions.\n\n## Secure SDLC Practices\n- Integrate Static Application Security Testing (SAST) and Software Composition Analysis (SCA) into the CI pipeline.\n- Scan all code for secrets before merging (Secret Scanning).\n- Use Infrastructure as Code (IaC) scanning for all infrastructure code.\n- Integrate Dynamic Application Security Testing (DAST) in the CD pipeline for deployed applications.\n- Enforce Policy as Code (PaC) for automated, version-controlled security policies.\n\n## Monitoring & Feedback\n- Enable continuous vulnerability monitoring and alerting.\n- Integrate Runtime Application Self-Protection (RASP) and Web Application Firewall (WAF) as appropriate.\n- Encourage regular vulnerability assessments and penetration testing.\n- Maintain a feedback loop to update rules and prompts based on recurring vulnerabilities.\n\n## Compliance & Documentation\n- Align with industry standards (e.g., OWASP Top 10, NIST, ISO 27001).\n- Document all security controls and decisions for auditability."},"items":[{"name":".cursorrules","path":".cursorrules (security-devsecops-ssdls-appsec.mdc)","rawUrl":"https://raw.githubusercontent.com/PatrickJS/awesome-cursorrules/main/rules/security-devsecops-ssdls-appsec.mdc","title":"Cursor rules for secure coding, secret handling, dependency hygiene, authentication, authorization, security testing, and compliance documentation.","category":"cursor-rule","format":"markdown","content":"# DevSecOps + SSDLC + AppSec Cursor Rule\n\n## General Security Principles\n- Never hardcode secrets, credentials, or API keys. Use environment variables or secure vaults for sensitive data.\n- Prohibit the inclusion of `.env`, secret config files, or unknown tokens in source control.\n- Never log sensitive data, secrets, or session tokens in application logs.\n- Validate and sanitize all user input. Escape output in HTML, JS, and SQL contexts.\n- Avoid unsafe functions such as `exec`, `eval`, or similar dynamic code execution.\n\n## Database Security\n- Use parameterized queries or ORM for all database access. Do not use string concatenation for query building.\n- Ensure database users have the least privilege required for their tasks.\n- Regularly review and update database access policies.\n\n## Dependency Management\n- Only use packages from verified sources.\n- Do not add new dependencies without explicit approval and security review.\n- Regularly update dependencies and scan for known vulnerabilities (SCA).\n\n## Authentication & Authorization\n- Use secure authentication frameworks; never implement custom authentication.\n- Store passwords using strong, salted hashes (e.g., Argon2, bcrypt).\n- Implement Role-Based Access Control (RBAC) for sensitive operations.\n- Enforce the principle of least privilege for APIs and UI actions.\n\n## Secure SDLC Practices\n- Integrate Static Application Security Testing (SAST) and Software Composition Analysis (SCA) into the CI pipeline.\n- Scan all code for secrets before merging (Secret Scanning).\n- Use Infrastructure as Code (IaC) scanning for all infrastructure code.\n- Integrate Dynamic Application Security Testing (DAST) in the CD pipeline for deployed applications.\n- Enforce Policy as Code (PaC) for automated, version-controlled security policies.\n\n## Monitoring & Feedback\n- Enable continuous vulnerability monitoring and alerting.\n- Integrate Runtime Application Self-Protection (RASP) and Web Application Firewall (WAF) as appropriate.\n- Encourage regular vulnerability assessments and penetration testing.\n- Maintain a feedback loop to update rules and prompts based on recurring vulnerabilities.\n\n## Compliance & Documentation\n- Align with industry standards (e.g., OWASP Top 10, NIST, ISO 27001).\n- Document all security controls and decisions for auditability.","frontmatter":{"description":"Cursor rules for secure coding, secret handling, dependency hygiene, authentication, authorization, security testing, and compliance documentation.","globs":["**/*.py","**/*.js","**/*.ts","**/*.go","**/*.java","**/*.rb","**/*.php","**/*.cs","**/*.sh"],"alwaysApply":true},"tokens":534,"sizeBytes":2318}],"systemPromptSnippet":"<yakaai_skills repo=\"ColorlibHQ/SECURITY\">\n<!-- File: .cursorrules (security-devsecops-ssdls-appsec.mdc) (Tokens: ~534 | Category: cursor-rule) -->\n# DevSecOps + SSDLC + AppSec Cursor Rule\n\n## General Security Principles\n- Never hardcode secrets, credentials, or API keys. Use environment variables or secure vaults for sensitive data.\n- Prohibit the inclusion of `.env`, secret config files, or unknown tokens in source control.\n- Never log sensitive data, secrets, or session tokens in application logs.\n- Validate and sanitize all user input. Escape output in HTML, JS, and SQL contexts.\n- Avoid unsafe functions such as `exec`, `eval`, or similar dynamic code execution.\n\n## Database Security\n- Use parameterized queries or ORM for all database access. Do not use string concatenation for query building.\n- Ensure database users have the least privilege required for their tasks.\n- Regularly review and update database access policies.\n\n## Dependency Management\n- Only use packages from verified sources.\n- Do not add new dependencies without explicit approval and security review.\n- Regularly update dependencies and scan for known vulnerabilities (SCA).\n\n## Authentication & Authorization\n- Use secure authentication frameworks; never implement custom authentication.\n- Store passwords using strong, salted hashes (e.g., Argon2, bcrypt).\n- Implement Role-Based Access Control (RBAC) for sensitive operations.\n- Enforce the principle of least privilege for APIs and UI actions.\n\n## Secure SDLC Practices\n- Integrate Static Application Security Testing (SAST) and Software Composition Analysis (SCA) into the CI pipeline.\n- Scan all code for secrets before merging (Secret Scanning).\n- Use Infrastructure as Code (IaC) scanning for all infrastructure code.\n- Integrate Dynamic Application Security Testing (DAST) in the CD pipeline for deployed applications.\n- Enforce Policy as Code (PaC) for automated, version-controlled security policies.\n\n## Monitoring & Feedback\n- Enable continuous vulnerability monitoring and alerting.\n- Integrate Runtime Application Self-Protection (RASP) and Web Application Firewall (WAF) as appropriate.\n- Encourage regular vulnerability assessments and penetration testing.\n- Maintain a feedback loop to update rules and prompts based on recurring vulnerabilities.\n\n## Compliance & Documentation\n- Align with industry standards (e.g., OWASP Top 10, NIST, ISO 27001).\n- Document all security controls and decisions for auditability.\n</yakaai_skills>"}