Name: security
Author: FreeOnur

Instruction file imported from FreeOnur/BallUp (.cursor/rules/security.mdc). Copyright stays with the author.

Secrets

Never commit Supabase URL/anon key, Google Maps keys, B2 keys, JWT secrets, or DB passwords
Flutter: use --dart-define=API_BASE_URL, SUPABASE_URL, SUPABASE_ANON_KEY — remove hardcoded values from main.dart
Google Maps: baller_app/android/.../AndroidManifest.xml · baller_app/ios/Runner/AppDelegate.swift — inject at build time
Backend: backend/.env from .env.example only; JWT_SECRET min 32 random bytes in production
B2: only server-side in API env (B2_KEY_ID, B2_APP_KEY)
.cursor/mcp.json — rotate exposed tokens; use env-based auth locally

Auth (self-hosted API)

Tokens in flutter_secure_storage via TokenStorage — never SharedPreferences
Access JWT short-lived; refresh via POST /auth/refresh
Legacy Supabase mode: migrate off before production; plan password reset for existing users

Auth (legacy Supabase)

auth_gate.dart — onAuthStateChange + profiles lookup when USE_LEGACY_SUPABASE=true
Deprecate after cutover — see auth-flow skill

Backend / Docker

Postgres not exposed on public internet in production
TLS via Coolify reverse proxy
Rate-limit login endpoints in production (proxy or app layer)

Permissions

iOS Info.plist: location + photo library usage strings
Android AndroidManifest.xml: location permissions as required by features

{ "ocm": "1", "id": "freeonur-ballup-security-rule", "kind": "skill", "name": "security", "description": "Security rules for API keys, auth, backend, and permissions", "publisher": "FreeOnur", "version": "1.0.0", "capabilities": { "domains": [ "coding" ], "tags": [ "skill-md", "github-cursor-rules" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Security rules for API keys, auth, backend, and permissions" ], "primary": false, "metadata": { "source": { "provider": "github-cursor-rules", "repository": "https://github.com/FreeOnur/BallUp", "path": ".cursor/rules/security.mdc", "ref": "6330e9bedbc629a966e388fcf4028ec838e07e6c", "url": "https://github.com/FreeOnur/BallUp/blob/6330e9bedbc629a966e388fcf4028ec838e07e6c/.cursor/rules/security.mdc", "key": "FreeOnur/BallUp/.cursor/rules/security.mdc" }, "applies_to": "baller_app/lib/**,baller_app/ios/Runner/AppDelegate.swift,baller_app/android/app/src/main/AndroidManifest.xml,backend/**" }, "instructions": "## Secrets\n\n- **Never** commit Supabase URL/anon key, Google Maps keys, B2 keys, JWT secrets, or DB passwords\n- Flutter: use `--dart-define=API_BASE_URL`, `SUPABASE_URL`, `SUPABASE_ANON_KEY` — remove hardcoded values from `main.dart`\n- Google Maps: `baller_app/android/.../AndroidManifest.xml` · `baller_app/ios/Runner/AppDelegate.swift` — inject at build time\n- Backend: `backend/.env` from `.env.example` only; `JWT_SECRET` min 32 random bytes in production\n- B2: only server-side in API env (`B2_KEY_ID`, `B2_APP_KEY`)\n- `.cursor/mcp.json` — rotate exposed tokens; use env-based auth locally\n\n## A", "cost": { "context_tokens": 339 } }

security

About

Secrets

Auth (self-hosted API)

Auth (legacy Supabase)

Backend / Docker

Permissions

Use it

Manifest

Reviews