Security rules for code review and vulnerability prevention.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Security Rules
## Before Every Commit
- [ ] No hardcoded secrets (API keys, passwords, tokens)
- [ ] User input is validated
- [ ] SQL injection prevented (parameterized queries)
- [ ] XSS prevented
- [ ] Error messages don't leak sensitive data
- [ ] CSRF protection in place
- [ ] Rate limiting on API endpoints
## Secret Management
```typescript
// WRONG
const apiKey = "sk-proj-xxxxx"
// RIGHT
const apiKey = process.env.OPENAI_API_KEY
if (!apiKey) throw new Error('OPENAI_API_KEY not configured')
```
## Dependencies
- Check for CVEs before adding new packages
- Keep dependencies up to date
- Audit with `npm audit` regularly
The line at the top of this page pins the label git:20260330.cd5da78, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
GET https://markdownregistry.com/api/v1/artifacts/art_3eyxcrkdgpe7ucp6
GET https://markdownregistry.com/api/v1/resolve?ref=vibeeval/vibecosystem/.cursor/rules/security.mdc
GET https://markdownregistry.com/api/v1/blob/7c96cf8f0cb48deb5e72b49825b0ffce3548a326e9a9f59204528de680cb899a
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
vibeeval/vibecosystem · skills/achievements/SKILL.md · Steam-style achievement system with XP, levels, streaks, and skill trees. Gamifies the development workflow. 25…
vibeeval/vibecosystem · skills/agent-benchmark/SKILL.md · Framework for measuring and tracking agent response quality over time. Detects regressions before they reach…
boshu2/agentops · skills/security/SKILL.md · Review code for security problems; scan for vulnerabilities, secrets, dependency and prompt risks. Use when: asked…
boshu2/agentops · plugin/skills/security/SKILL.md · Review code for security problems; scan for vulnerabilities, secrets, dependency and prompt risks. Use when: asked…
