security devsecops ssdls appsec
via PatrickJS/awesome-cursorrules
Secure coding, secrets management, dependency hygiene, and SSDLC practices across multiple languages.
What is security devsecops ssdls appsec?
Enforces DevSecOps and secure software development lifecycle (SSDLC) practices including secret handling, input validation, secure authentication, and automated security testing. Use this rule to prevent common vulnerabilities, enforce least-privilege access, and maintain compliance with security standards like OWASP Top 10 and NIST.
- Prohibit hardcoded secrets, credentials, and API keys; enforce environment variables and secure vaults
- Require parameterized queries and ORM for database access; prevent SQL injection via string concatenation
- Mandate strong password hashing (Argon2, bcrypt) and Role-Based Access Control (RBAC) for authentication and authorization
- Enforce input validation, output escaping, and prohibition of unsafe functions (exec, eval)
- Integrate SAST, SCA, Secret Scanning, and DAST into CI/CD pipelines for continuous vulnerability detection
- Require Infrastructure as Code (IaC) scanning and Policy as Code (PaC) for automated security governance
Applies to
Always applied, in addition to these file patterns.
Rule definition (reference)
Source of truth, from the repository.
DevSecOps + SSDLC + AppSec Cursor Rule
General Security Principles
- Never hardcode secrets, credentials, or API keys. Use environment variables or secure vaults for sensitive data.
- Prohibit the inclusion of
.env, secret config files, or unknown tokens in source control. - Never log sensitive data, secrets, or session tokens in application logs.
- Validate and sanitize all user input. Escape output in HTML, JS, and SQL contexts.
- Avoid unsafe functions such as
exec,eval, or similar dynamic code execution.
Database Security
- Use parameterized queries or ORM for all database access. Do not use string concatenation for query building.
- Ensure database users have the least privilege required for their tasks.
- Regularly review and update database access policies.
Dependency Management
- Only use packages from verified sources.
- Do not add new dependencies without explicit approval and security review.
- Regularly update dependencies and scan for known vulnerabilities (SCA).
Authentication & Authorization
- Use secure authentication frameworks; never implement custom authentication.
- Store passwords using strong, salted hashes (e.g., Argon2, bcrypt).
- Implement Role-Based Access Control (RBAC) for sensitive operations.
- Enforce the principle of least privilege for APIs and UI actions.
Secure SDLC Practices
- Integrate Static Application Security Testing (SAST) and Software Composition Analysis (SCA) into the CI pipeline.
- Scan all code for secrets before merging (Secret Scanning).
- Use Infrastructure as Code (IaC) scanning for all infrastructure code.
- Integrate Dynamic Application Security Testing (DAST) in the CD pipeline for deployed applications.
- Enforce Policy as Code (PaC) for automated, version-controlled security policies.
Monitoring & Feedback
- Enable continuous vulnerability monitoring and alerting.
- Integrate Runtime Application Self-Protection (RASP) and Web Application Firewall (WAF) as appropriate.
- Encourage regular vulnerability assessments and penetration testing.
- Maintain a feedback loop to update rules and prompts based on recurring vulnerabilities.
Compliance & Documentation
- Align with industry standards (e.g., OWASP Top 10, NIST, ISO 27001).
- Document all security controls and decisions for auditability.
Related rules
Senior full-stack TypeScript, React, Node.js guidance with clean architecture, testing, and WHY-oriented reasoning.
Quantitative factor research skills for designing, evaluating, and mining alpha factors in equities markets.
Android development with Jetpack Compose, clean architecture, and Material Design 3.
Angular development with Novo Elements UI library using standalone components.
Expert Angular 18 + TypeScript development with Jest, emphasizing clean code and performance.
Manage Kubernetes clusters, add-ons, stacks, and credentials via the Ankra CLI platform.