general-secrets

Name: general-secrets
Author: nathanjohnson320

Secrets — never commit, log, or ship credentials to the client

by nathanjohnson320(0) 0 installs

Free

Free account. Installing gives you the manifest plus copy-paste snippets.

See reviews

About

Instruction file imported from nathanjohnson320/hospitality-demo (.cursor/rules/general-secrets.mdc). Copyright stays with the author.

Secrets

Never commit .env, .env.* (except .env.example), credentials.json, *service-account*.json, private keys, or .npmrc with auth tokens.
Never log Authorization, Cookie, JWTs, DATABASE_URL, SECRET_KEY_BASE, API keys, or session tokens. Redact if a logger dumps headers.
Client bundles (VITE_*, PUBLIC_*, Lustre/Vite UI) get non-secrets only (publishable Clerk key is fine; secret keys are not).
Don't hardcode secrets in source, tests, Docker Compose defaults meant for production, or chat replies. Use env / the app's vault.
Don't paste production dumps, live tokens, or private keys into the conversation.
SQL stays parameterized (Squirrel $1, Ecto queries) — no string-interpolated user input into queries.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

# after Install: the listing is in your workspace's routing pool - a plan picks it for its slot
curl -s -X POST https://api.opensmartroute.ai/api/v1/route -H 'Authorization: Bearer $OSR_API_KEY' -H 'Content-Type: application/json' -d '{"text": "...", "plan": true}'

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

nathanjohnson320-hospitality-demo-general-secrets-rule.ocm.jsonjson

{
  "ocm": "1",
  "id": "nathanjohnson320-hospitality-demo-general-secrets-rule",
  "kind": "skill",
  "name": "general-secrets",
  "description": "Secrets — never commit, log, or ship credentials to the client",
  "publisher": "nathanjohnson320",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "github-cursor-rules"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Secrets — never commit, log, or ship credentials to the client"
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github-cursor-rules",
      "repository": "https://github.com/nathanjohnson320/hospitality-demo",
      "path": ".cursor/rules/general-secrets.mdc",
      "ref": "aafe813bc31031261173c695a2359de037e83b4e",
      "url": "https://github.com/nathanjohnson320/hospitality-demo/blob/aafe813bc31031261173c695a2359de037e83b4e/.cursor/rules/general-secrets.mdc",
      "key": "nathanjohnson320/hospitality-demo/.cursor/rules/general-secrets.mdc"
    }
  },
  "instructions": "# Secrets\n\n- Never commit `.env`, `.env.*` (except `.env.example`), `credentials.json`, `*service-account*.json`, private keys, or `.npmrc` with auth tokens.\n- Never log `Authorization`, `Cookie`, JWTs, `DATABASE_URL`, `SECRET_KEY_BASE`, API keys, or session tokens. Redact if a logger dumps headers.\n- Client bundles (`VITE_*`, `PUBLIC_*`, Lustre/Vite UI) get **non-secrets only** (publishable Clerk key is fine; secret keys are not).\n- Don't hardcode secrets in source, tests, Docker Compose defaults meant for production, or chat replies. Use env / the app's vault.\n- Don't paste production dumps,",
  "cost": {
    "context_tokens": 189
  }
}

Fetch it by URL: GET /api/v1/registry/nathanjohnson320-hospitality-demo-general-secrets-rule/manifest?version=1.0.0

About

Secrets

Use it

Manifest

Reviews