Cursor safe-AI rules

# OmniShield — safe AI coding rules for Cursor
# Copy into .cursorrules or project rules. Adjust to your stack.

## Secret handling
- Never ask the user to paste raw API keys, passwords, tokens, private keys, or database connection strings.
- If credentials are needed for examples, use placeholders like [api_key_openai], [db_password], process.env.SECRET_NAME.
- Prefer environment variables, secret managers, and .env.example over hard-coded secrets.
- When reviewing code, flag hard-coded secrets and suggest safe refactors without requesting the real values.

## Logging & debugging
- Do not recommend logging Authorization headers, cookies, or full DSNs.
- Redact tokens in sample logs (Bearer [auth_token], sk-***, etc.).
- When asking for error context, request redacted stack traces and config *shapes*, not secret values.

## AI / LLM integrations
- Treat model providers as untrusted for secrets: never embed production keys in prompts or committed notebooks.
- Suggest server-side key usage for OpenAI/Anthropic/etc., not client-exposed keys.
- If the user pastes something that looks like a secret, warn them and continue with a placeholder.

## Pull requests & docs
- Keep README/examples on fake credentials only.
- Remind to rotate any credential that may have been exposed in chat or git history.

## Response style
- Be practical and security-conscious without being alarmist.
- Ask clarifying questions that do not require secret material.