Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/abderrahimghazali/cursor-rules/javascript-identification-authentication-failuresgit clone --depth 1 https://github.com/abderrahimghazali/cursor-rulesWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.04519 | $0.04519 |
| Opus 5 | $0.02259 | $0.02259 |
| Sonnet 5 | $0.00904 | $0.00904 |
| Haiku 4.5 | $0.00452 | $0.00452 |
Grade A, and why
javascript-identification-authentication-failures scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLlowData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
const response = await fetch('https://www.google.com/recaptcha/api/siteverify', { method: 'POST', Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
This is a copy
100% identical to javascript-identification-authentication-failures — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 494 lines — stays where its author put it; the contents beside it link to each section on GitHub.
description: Detect and prevent identification and authentication failures in JavaScript applications as defined in OWASP Top 10:2021-A07 globs: /.js, **/.jsx, /.ts, **/.tsx, !/node_modules/, !/dist/, !/build/, !/coverage/
JavaScript Identification and Authentication Failures (OWASP A07:2021)
actions:
-
type: enforce conditions:
Pattern 1: Weak Password Validation
- pattern: "(?:password|passwd|pwd)\s*\.\s*(?:length\s*[<>]=?\s*(?:[0-9]|10)\b|match\(\s*['"][^'"]['"]\s\))" message: "Weak password validation detected. Implement strong password policies requiring minimum length, complexity, and avoiding common passwords."
Pattern 2: Missing MFA Implementation
- pattern: "(?:login|signin|authenticate|auth)\s*\([^)]\)\s\{[^}]*?\}" negative_pattern: "(?:mfa|2fa|two-factor|multi-factor|otp|totp)" message: "Authentication implementation without multi-factor authentication (MFA). Consider implementing MFA for enhanced security."
Pattern 3: Hardcoded Credentials
- pattern: "(?:const|let|var)\s+(?:password|passwd|pwd|secret|key|token|apiKey)\s*=\s*['"][^'"]+['"]" message: "Hardcoded credentials detected. Store sensitive authentication data in secure configuration or environment variables."
Pattern 4: Insecure Session Management
- pattern: "(?:localStorage|sessionStorage)\.setItem\('"['"]" message: "Storing authentication tokens in localStorage or sessionStorage. Consider using HttpOnly cookies for sensitive authentication data."
Pattern 5: Missing CSRF Protection
- pattern: "(?:post|put|delete|patch)\([^)]*?\)" negative_pattern: "(?:csrf|xsrf|token)" location: "(?:src|components|pages|api)" message: "Potential missing CSRF protection in API requests. Implement CSRF tokens for state-changing operations."
Pattern 6: Insecure JWT Handling
- pattern: "jwt\.sign\([^)]?{[^}]?}\s*,\s*[^,)]+\s*(?:\)|,\s*{\s*(?:expiresIn|algorithm)\s*:\s*[^}]?}\s\))" negative_pattern: "(?:expiresIn|exp).*(?:algorithm|alg)" message: "Insecure JWT configuration. Ensure JWTs have proper expiration and use secure algorithms (RS256 preferred over HS256)."
Pattern 7: Insecure Password Storage
- pattern: "(?:bcrypt|argon2|pbkdf2|scrypt)\.[^(]\([^)]?(?:rounds|iterations|cost|factor)\s*[:<=>]\s*(?:[0-9]|1[0-2])\b" message: "Weak password hashing parameters. Use sufficient work factors for password hashing algorithms."
Pattern 8: Missing Account Lockout
- pattern: "(?:login|signin|authenticate|auth)\s*\([^)]\)\s\{[^}]*?\}" negative_pattern: "(?:lock|attempt|count|limit|throttle|rate)" message: "Authentication implementation without account lockout or rate limiting. Implement account lockout after failed attempts."
Pattern 9: Insecure Password Recovery
- pattern: "(?:reset|forgot|recover)(?:Password|Pwd)\s*\([^)]\)\s\{[^}]*?\}" negative_pattern: "(?:expire|timeout|token|verify)" message: "Potentially insecure password recovery mechanism. Implement secure, time-limited recovery tokens."
Pattern 10: Missing Brute Force Protection
- pattern: "(?:login|signin|authenticate|auth)\s*\([^)]\)\s\{[^}]?\}" negative_pattern: "(?:captcha|recaptcha|hcaptcha|rate\slimit)" message: "Authentication without CAPTCHA or rate limiting. Implement protection against brute force attacks."
Pattern 11: Insecure Remember Me Functionality
- pattern: "(?:rememberMe|keepLoggedIn|staySignedIn)" negative_pattern: "(?:secure|httpOnly|sameSite)" message: "Potentially insecure 'Remember Me' functionality. Implement with secure, HttpOnly cookies and proper expiration."
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 494 lines · 4,519 tokens per session scan A 5c44655b488b
javascript-identification-authentication-failures is a cursor rule published in the GitHub repository abderrahimghazali/cursor-rules (2 stars, last pushed 1y ago), licensed MIT. It adds 4,519 tokens to every session, about $0.0226 per session on Opus 5. A static security scan graded it A with 1 finding (sends data to an external url). It is 100% identical to javascript-identification-authentication-failures, differing in 0 lines, and is treated as a copy.
Other cursor rules, from other repositories
creating-cursor-rules
Meta-rule for creating effective Cursor IDE rules with best practices, patterns, and examples.
creating-skills
Meta-guide for creating effective Claude Code skills with proper structure, CSO optimization, and real examples.
cursorrules
You are a disciplined senior engineer working with someone who may be a domain expert, not a programmer. Build it correctly and safely, not just fast.
cursorrules
Cursor rule "cursorrules" from BlueBirdBack/godot-cursorrules, covering godot 4.4 game development .cursorrules, core development guidelines, code style, naming conventions and scene organization.
new_feature
You are an expert Product Owner and Technical Lead focused on helping users define and plan new features through collaborative discovery and structured documentation.
new_project
You are an expert Product Owner focused on helping users define new software projects through collaborative vision creation.