Cursor rule Cursor ✓ vendor
Global white-box security review guidance for Atlassian Forge app source code.
not rated 25 2d ago A 1,817 tokens
original Apache-2.0
25Stars on the repository
42Mods indexed here, across every type
2d agoLast push, which is what freshness is scored on
Apache-2.0Licence, which decides whether bodies are shown
Cursor rule Cursor ✓ vendor
Forge auditing rules index (logging, error handling, SAST). Auto-attached for forge-auditing/.
not rated 25 2d ago A 0 tokens
original Apache-2.0
Cursor rule Cursor needs its repo ✓ vendor
Static analysis tools and patterns for Forge app security review.
not rated 25 2d ago A 10 tokens
original Apache-2.0
Cursor rule Cursor ✓ vendor
Forge authentication and authorization rules index. Auto-attached for forge-authn-authz/.
not rated 25 2d ago A 0 tokens
original Apache-2.0
Cursor rule Cursor ✓ vendor
Detect privilege escalation risks via asApp() calls without proper authorization checks.
not rated 25 2d ago A 13 tokens
original Apache-2.0
Cursor rule Cursor ✓ vendor
Detect reliance on display conditions as authorization controls in Forge apps.
not rated 25 2d ago A 11 tokens
original Apache-2.0
Cursor rule Cursor ✓ vendor
Detect missing authorization checks in Forge resolvers for sensitive operations.
not rated 25 2d ago A 11 tokens
original Apache-2.0
Cursor rule Cursor ✓ vendor
Context object should be preferred over explicit inclusion in function payload.
not rated 25 2d ago A 1,205 tokens
original Apache-2.0
Cursor rule Cursor ✓ vendor
Forge egress and remotes rules index. Auto-attached for forge-egress-remotes/.
not rated 25 2d ago A 0 tokens
original Apache-2.0
Cursor rule Cursor ✓ vendor
Detect data egress via window.location redirects in Forge Custom UI.
not rated 25
changed 2d ago A 12 tokens
original Apache-2.0
Cursor rule Cursor ✓ vendor
Detect insecure wildcard patterns in Forge external permissions and remotes.
not rated 25 2d ago A 11 tokens
original Apache-2.0
Cursor rule Cursor ✓ vendor
Forge injection rules index. Auto-attached for forge-injection/.
not rated 25 2d ago A 0 tokens
original Apache-2.0
Cursor rule Cursor ✓ vendor
Detect prototype pollution vulnerabilities in Forge apps and RuntimeV2 escalation risks.
not rated 25 2d ago A 13 tokens
original Apache-2.0
Cursor rule Cursor ✓ vendor
Detect remote code execution and unsafe dynamic code evaluation in Forge apps.
not rated 25 2d ago A 12 tokens
original Apache-2.0
Cursor rule Cursor ✓ vendor
Detect SQL injection vulnerabilities in Forge apps using the Forge SQL API.
not rated 25 2d ago A 12 tokens
original Apache-2.0
ssrf
16Cursor rule Cursor needs its repo ✓ vendor
Detect SSRF vulnerabilities in Forge apps via requestJira, requestConfluence, and fetch.
not rated 25 2d ago C 18 tokens
original Apache-2.0
xss
17Cursor rule Cursor ✓ vendor
Detect Cross-Site Scripting vulnerabilities in Forge Custom UI apps.
not rated 25 2d ago A 12 tokens
original Apache-2.0
Cursor rule Cursor ✓ vendor
Forge manifest and platform configuration rules index. Auto-attached for forge-manifest-config/.
not rated 25 2d ago A 0 tokens
original Apache-2.0
Cursor rule Cursor ✓ vendor
Detect insecure Content Security Policy configurations in Forge app manifests.
not rated 25 2d ago A 10 tokens
original Apache-2.0
Cursor rule Cursor ✓ vendor
Review Forge app egress list for misleading entries.
not rated 25 2d ago A 9 tokens
original Apache-2.0
Cursor rule Cursor ✓ vendor
Review Forge app permission scopes for least privilege and scope justification.
not rated 25 2d ago A 11 tokens
original Apache-2.0
_index-misc
22Cursor rule Cursor ✓ vendor
Forge miscellaneous security rules index. Auto-attached for forge-misc/.
not rated 25 2d ago A 0 tokens
original Apache-2.0
Cursor rule Cursor ✓ vendor
Software Composition Analysis for Forge app dependencies.
not rated 25 2d ago A 7 tokens
original Apache-2.0
Cursor rule Cursor ✓ vendor
Forge Rovo agents rules index. Auto-attached for forge-rovo-agents/.
not rated 25 2d ago A 0 tokens
original Apache-2.0
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: