Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/lsampaioweb/ai-instructionsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/lsampaioweb/ai-instructions/spring-boot-tls)<a href="https://agentmods.dev/rules/lsampaioweb/ai-instructions/spring-boot-tls"><img src="https://agentmods.dev/badge/rules/lsampaioweb/ai-instructions/spring-boot-tls/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/lsampaioweb/ai-instructions/spring-boot-tls"><img src="https://agentmods.dev/badge/rules/lsampaioweb/ai-instructions/spring-boot-tls.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00788 |
| Opus 5.5 | $0.00000 | $0.00315 |
| Sonnet 5.5 | $0.00000 | $0.00158 |
| Haiku 4.5 | $0.00000 | $0.00079 |
Grade A, and why
spring-boot-tls scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 14d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Spring Boot HTTPS and TLS Contract
These rules apply when an application terminates HTTPS itself or defines TLS-related runtime settings. They do not require embedded TLS when a trusted reverse proxy or ingress terminates TLS before traffic reaches the application.
Ownership
- Defer general YAML structure, profiles, environment variables, and secret handling
to
spring-boot-config.mdc. - Defer certificate and keystore ignore patterns to
spring-boot-gitignore.mdc. - Defer endpoint authorization and anonymous-access rules to
spring-boot-security.mdc. - Defer human-facing setup and certificate instructions to
spring-boot-readme.mdc. - Keep proxy-specific TLS termination, routing, and middleware rules in the deployment or proxy contract that owns them.
Embedded TLS
- Enable
server.ssl.enabledonly when the Spring Boot application terminates TLS. - Use a PKCS12 keystore for embedded HTTPS unless an explicit compatibility requirement requires another supported store type.
- Supply the keystore password through an environment variable or external secret source.
- Keep the keystore path, store type, enabled protocols, and HTTPS port in environment-appropriate configuration.
- Enable TLS 1.3 as the minimum protocol baseline unless a documented client compatibility requirement requires a different supported protocol set.
- Enable HTTP/2 only when the deployment and clients support it; do not add it merely because HTTPS is enabled.
- Keep development and production TLS settings in their matching profile files when the settings differ by environment.
- Use a truststore only when the application must validate client certificates or outbound peer certificates. Do not add mutual TLS by default.
- Make the TLS termination boundary explicit when a reverse proxy, ingress, or service mesh terminates HTTPS before the application.
Certificate material
- Keep private keys, keystores, truststores, and certificate passwords outside source control.
- Load certificate passwords and externally managed certificate paths from the environment or an approved secret source.
- Use local-only development certificates only when they are clearly isolated from production material.
- Document the required certificate, keystore, and truststore inputs without including private material or real passwords.
- Do not copy certificate material into Docker images or committed application resources.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 14d ago First seen · 81 lines · 0 tokens per session scan A 74b42e4d986d
spring-boot-tls is a cursor rule published in the GitHub repository lsampaioweb/ai-instructions (1 stars, last pushed 14d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 788 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-04.
Other cursor rules, from other repositories
api-property-optionality-hygiene
Fix ApiProperty/ApiPropertyOptional optionality mismatches in DTO files; use for scheduled batch fixes or DTO edits.
python
Python best practices and patterns for modern software development with Flask and SQLite.
cursor
You are working on the checkout service. Preserve transaction integrity and auditability.
django
Definitive guidelines for writing maintainable, performant, and secure Django applications, emphasizing modern best practices, clear code organization, and efficient patterns.
shared-libraries
Shared libraries - condition framework, inventory containers, file-backed DB, itinerary, references.
selectools-providers
Rules for working with LLM provider adapters in selectools.