Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/girijashankarj/cursor-handbookWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/girijashankarj/cursor-handbook/guardrails)<a href="https://agentmods.dev/rules/girijashankarj/cursor-handbook/guardrails"><img src="https://agentmods.dev/badge/rules/girijashankarj/cursor-handbook/guardrails.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00788 | $0.00788 |
| Opus 5 | $0.00394 | $0.00394 |
| Sonnet 5 | $0.00158 | $0.00158 |
| Haiku 4.5 | $0.00079 | $0.00079 |
Grade A, and why
guardrails scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Guardrails
Absolute Rules (NEVER Violate)
1. Secrets Management
- NEVER hardcode any of the following in source code:
- API keys, tokens, or credentials
- Database connection strings with passwords
- Private keys or certificates
- Webhook URLs with secrets
- ALWAYS use environment variables:
process.env.VARIABLE_NAME - ALWAYS use a secrets manager for production: AWS Secrets Manager, Vault, etc.
- Reference secrets via:
{{CONFIG.techStack.cloud}}secrets manager
2. PII Protection
- NEVER log personally identifiable information:
- Full names, email addresses, phone numbers
- Social Security Numbers, tax IDs
- Credit card numbers, bank account numbers
- IP addresses (in most contexts)
- Physical addresses, dates of birth
- When logging user-related operations, use only:
userId,sessionId,correlationId - Mask data in logs:
email: "j***@example.com",phone: "***-***-1234"
3. Infrastructure Obfuscation
- NEVER include real infrastructure names in:
- Code comments
- Documentation
- Error messages shown to users
- Git commit messages
- Use generic placeholders:
[AWS_ACCOUNT_ID]instead of actual account numbers[QUEUE_NAME]instead of actual SQS/queue names[API_ENDPOINT]instead of actual URLs[BUCKET_NAME]instead of actual S3 bucket names[DB_HOST]instead of actual database hostnames
4. Input Validation
- Validate ALL user input at the API boundary
- Use allowlists over denylists
- Sanitize data before database queries (parameterized queries only)
- Validate file uploads: type, size, content
- Rate limit all public endpoints
5. Authentication & Authorization
- Never store passwords in plain text
- Use bcrypt/argon2 for password hashing
- Implement proper session management
- Use short-lived tokens with refresh mechanism
- Apply principle of least privilege for all operations
Code Review Security Checklist
Before approving any code change, verify:
- No hardcoded secrets or credentials
- No PII in logs or error messages
- Input validation on all external inputs
- Parameterized database queries (no string concatenation)
- Proper error handling (no stack traces to users)
- Authentication checks on protected routes
- Authorization checks for resource access
- No sensitive data in URL parameters
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 90 lines · 788 tokens per session scan A f33c3b026bc2
guardrails is a cursor rule published in the GitHub repository girijashankarj/cursor-handbook (30 stars, last pushed 8d ago), licensed MIT. It adds 788 tokens to every session, about $0.0039 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other cursor rules, from other repositories
graphstack
GraphStack v4.7.1 — Orchestrated, graph-first, GNAP-tracked AI development (cross-platform).
code-optimization
Guidelines for optimizing duplicate and poorly structured code.
new_features
Guidelines for integrating new features into the Task Master CLI.
commands
Guidelines for implementing CLI commands using Commander.js.
mcp
Guidelines for implementing and interacting with the Task Master MCP Server.
git_workflow
Git workflow integrated with Task Master for feature development and collaboration.