javascript-cryptographic-failures

A set of JavaScript and TypeScript checks for common cryptography mistakes, such as weak hashing, hardcoded secrets, unsafe random numbers, and insecure TLS settings.

In plain words
What is it for?
Use it while reviewing JavaScript or TypeScript files to find unsafe security-related code and suggest safer alternatives.
Why use it?
It helps catch security weaknesses in code before they expose passwords, keys, or other sensitive data.

Cursor rule for Cursor

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/abderrahimghazali/cursor-rules/javascript-cryptographic-failures
Clone the repo
git clone --depth 1 https://github.com/abderrahimghazali/cursor-rules

Made for: Cursor.

Per session 3,081 This file is loaded in full into every session.
When invoked 3,081 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin 100% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.03081 $0.03081
Opus 5 $0.01541 $0.01541
Sonnet 5 $0.00616 $0.00616
Haiku 4.5 $0.00308 $0.00308

Measured yesterday against content hash febbc9dfb645, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

javascript-cryptographic-failures scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

This is a copy

100% identical to javascript-cryptographic-failures — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

.cursor/rules/javascript-cryptographic-failures.mdc · 305 lines

How it starts

The opening of the file, as written. The whole thing — 305 lines — stays where its author put it; the contents beside it link to each section on GitHub.


description: Detect and prevent cryptographic failures in JavaScript applications as defined in OWASP Top 10:2021-A02 globs: /.js, **/.jsx, /.ts, **/.tsx, !/node_modules/, !/dist/, !/build/, !/coverage/

JavaScript Cryptographic Failures (OWASP A02:2021)

actions:

  • type: enforce conditions:

    Pattern 1: Weak or insecure cryptographic algorithms

    • pattern: "(?:createHash|crypto\.createHash)\('"['"]\)|(?:crypto|require\(['"]crypto['"]\))\.(?:createHash|Hash)\('"['"]\)|new (?:MD5|SHA1)\(|CryptoJS\.(?:MD5|SHA1)\(" message: "Using weak hashing algorithms (MD5/SHA1). Use SHA-256 or stronger algorithms."

    Pattern 2: Hardcoded secrets/credentials

    • pattern: "(?:const|let|var)\s+(?:password|secret|key|token|auth|apiKey|api_key)\s*=\s*['"][^'"]+['"]" message: "Potential hardcoded credentials detected. Store secrets in environment variables or a secure vault."

    Pattern 3: Insecure random number generation

    • pattern: "Math\.random\(\)|Math\.floor\(\sMath\.random\(\)\s\*" message: "Using Math.random() for security purposes. Use crypto.randomBytes() or Web Crypto API for cryptographic operations."

    Pattern 4: Weak SSL/TLS configuration

    • pattern: "(?:tls|https|require\(['"]https['"]\)|require\(['"]tls['"]\))\.(?:createServer|request|get)\([^\)]?{[^}]?secureProtocol\s*:\s*'"['"]" message: "Using deprecated/insecure SSL/TLS protocol versions. Use TLS 1.2+ for secure communications."

    Pattern 5: Missing certificate validation

    • pattern: "(?:rejectUnauthorized|strictSSL)\s*:\s*false" message: "SSL certificate validation is disabled. Always validate certificates in production environments."

    Pattern 6: Insecure cipher usage

    • pattern: "(?:createCipheriv|crypto\.createCipheriv)\('"['"]" message: "Using insecure encryption cipher or mode. Use AES with GCM or CBC mode with proper padding."

    Pattern 7: Insufficient key length

    • pattern: "(?:generateKeyPair|generateKeyPairSync)\([^,]?['"]rsa['"][^,]?{[^}]?modulusLength\s:\s*(\d{1,3}|1[0-9]{3}|20[0-3][0-9]|204[0-7])\s*}" message: "Using insufficient key length for asymmetric encryption. RSA keys should be at least 2048 bits, preferably 4096 bits."

    Pattern 8: Insecure password hashing

    • pattern: "(?:createHash|crypto\.createHash)\([^)]?\)\.(?:update|digest)\([^)]?\)|CryptoJS\.(?:SHA256|SHA512|SHA3)\([^)]*?\)" negative_pattern: "(?:bcrypt|scrypt|pbkdf2|argon2)" message: "Using plain hashing for passwords. Use dedicated password hashing functions like bcrypt, scrypt, or PBKDF2."

    Pattern 9: Missing salt in password hashing

    • pattern: "(?:pbkdf2|pbkdf2Sync)\([^,]+,[^,]+,[^,]+,\s*\d+\s*,[^,]+\)" negative_pattern: "(?:salt|crypto\.randomBytes)" message: "Ensure you're using a proper random salt with password hashing functions."
    • pattern: "(?:document\.cookie|cookies\.set|res\.cookie|cookie\.serialize)\([^)]?\)" negative_pattern: "(?:secure\s:|httpOnly\s*:|sameSite\s*:)" message: "Cookies with sensitive data should have secure and httpOnly flags enabled."

    Pattern 11: Client-side encryption

    • pattern: "(?:encrypt|decrypt|createCipher|createDecipher)\([^)]*?\)" location: "(?:frontend|client|browser|react|vue|angular)" message: "Performing sensitive cryptographic operations on the client side. Move encryption/decryption logic to the server."

Read the full file on GitHub · 305 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 305 lines · 3,081 tokens per session scan A febbc9dfb645

Subscribe to this mod's changes

javascript-cryptographic-failures is a cursor rule published in the GitHub repository abderrahimghazali/cursor-rules (2 stars, last pushed 1y ago), licensed MIT. It adds 3,081 tokens to every session, about $0.0154 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to javascript-cryptographic-failures, differing in 0 lines, and is treated as a copy.