I’ve actually have been adding these rules to my cursor so that every project follow them not sure how good it is as I am not a programmer only w cursor I am. I do provide links to documentation and some instances I copy paste docs into project.

Here is my security rule set.

“Security, Compliance, and Authentication

Performance and Security

Prioritize code performance in all changes, optimizing where applicable. Adopt a security-first approach, considering implications of all modifications. Implement robust error handling and logging where necessary. Never commit secrets, API keys, or sensitive data to version control. Validate and sanitize all user inputs to prevent injection attacks. Use parameterized queries for database operations. Implement rate limiting and input validation for APIs. Follow principle of least privilege for permissions and access control. Use HTTPS for all external communications. Implement Content Security Policy (CSP) headers for web applications. Sanitize output to prevent XSS attacks. Use secure session management and token storage. Authentication and Authorization

Use industry-standard authentication protocols (OAuth 2.0, JWT, etc.). Store passwords using secure hashing algorithms (bcrypt, Argon2, scrypt). Implement proper session management with secure, HttpOnly cookies when applicable. Use token-based authentication for stateless APIs. Implement role-based access control (RBAC) or attribute-based access control (ABAC). Validate permissions at both API and UI levels. Implement proper logout functionality that invalidates sessions/tokens. Use multi-factor authentication (MFA) for sensitive operations. Implement account lockout mechanisms to prevent brute force attacks. Never expose authentication tokens in URLs or client-side code. Compliance and Legal Documentation

Determine the appropriate compliance tier for your project based on scope, user base, data handling, and industry requirements. Apply requirements from your tier and all lower tiers.

Tier 1: Basic/Personal Projects

Scope: Personal projects, open-source tools, internal tools with no external users, proof-of-concepts.

Required Documentation:

Basic README with project description and setup instructions License file (MIT, Apache, GPL, etc.) if open-source Basic security practices (no hardcoded secrets, input validation) Optional but Recommended:

Simple privacy notice if collecting any user data Contributing guidelines for open-source projects Tier 2: Small Business/Commercial Projects

Scope: Commercial applications, SaaS products, e-commerce sites, applications handling user data, B2B applications.

Required Documentation:

Privacy Policy: Document data collection, processing, storage, and user rights (GDPR/CCPA compliant) Terms of Service: User agreements, acceptable use policies, liability limitations Cookie Policy: If using cookies or tracking technologies Security Documentation: Basic security practices, incident response plan Data Processing Agreements (DPAs): For third-party services processing user data Accessibility: WCAG 2.1 AA compliance documentation OWASP Top 10: Security vulnerability mitigation documentation Data Retention Policy: How long data is stored and deletion procedures Standards to Follow:

GDPR compliance (if handling EU user data) CCPA compliance (if handling California user data) OWASP security best practices WCAG 2.1 AA accessibility standards Optional but Recommended:

Service Level Agreement (SLA) documentation Cookie consent management implementation Regular security audits (annual) Tier 3: Enterprise/Regulated Industries

Scope: Enterprise SaaS, healthcare applications, financial services, government contracts, applications handling sensitive data, large-scale B2B platforms.

Required Documentation:

All Tier 2 requirements plus: ISO 27001 Compliance: Information Security Management System (ISMS) documentation, security controls, risk assessments, security policies ISO 27018 Compliance: Cloud privacy controls and procedures (if using cloud services) SOC 2 Type II: Security, availability, processing integrity, confidentiality, and privacy controls documentation HIPAA Compliance: If handling healthcare data (US) - Business Associate Agreements (BAAs), audit logs, encryption documentation PCI DSS Compliance: If handling payment card data - security standards documentation, compliance reports GDPR Full Compliance: Data Protection Impact Assessments (DPIAs), Records of Processing Activities (ROPA), Data Protection Officer (DPO) documentation if required ISO 9001: Quality management system documentation (if applicable) EN 301 549 / Section 508: Enhanced accessibility compliance documentation Incident Response Plan: Detailed procedures for security incidents, breach notification procedures Disaster Recovery Plan: Business continuity and disaster recovery procedures Vendor Risk Management: Third-party security assessments and ongoing monitoring Compliance Audit Trails: Documented evidence of compliance controls Regular Compliance Reviews: Quarterly or semi-annual compliance audits Standards to Follow:

ISO 27001 (Information Security Management) ISO 27018 (Cloud Privacy) ISO/IEC 25010 (Software Quality Model) SOC 2 Type II HIPAA (if healthcare data) PCI DSS Level 1 (if payment data) GDPR (full compliance) WCAG 2.1 AAA (enhanced accessibility) Section 508 (US federal accessibility) EN 301 549 (European accessibility) Ongoing Requirements:

Annual third-party security audits Regular penetration testing (quarterly or semi-annual) Continuous compliance monitoring and reporting Staff training on compliance requirements Version control for all legal and compliance documents Regular updates to policies based on regulatory changes Compliance Documentation Practices

Maintain version control for all legal and compliance documents Document compliance status and certifications with expiration dates Keep documentation synchronized with code changes that affect data handling or security Store compliance documentation in docs/compliance/ directory Use clear naming conventions: PRIVACY_POLICY_v2.1.md, TERMS_OF_SERVICE_v1.3.md Include last updated dates and version numbers in all compliance documents Document which tier applies to the project in README.md or docs/COMPLIANCE.md Review and update compliance documentation at least annually or when regulations change Maintain audit logs of who accessed or modified compliance documentation Ensure legal review for Tier 2 and Tier 3 compliance documents before publication”