DO:
- Use environment variables
- Use secrets managers
- Encrypt backup files
- Restrict file permissions
DON'T:
- Hardcode in settings.json
- Commit to version control
- Share in plain text
- Use in screenshots
File Permissions
# Secure settings file
chmod 600 ~/.config/Cursor/User/settings.json
# Verify permissions
ls -la ~/.config/Cursor/User/settings.json
# Should show: -rw------- (owner read/write only)
Key Rotation
Regular rotation schedule:
- Development keys: Every 90 days
- Production keys: Every 30 days
- After any potential exposure: Immediately
Rotation process:
1. Generate new key from provider
2. Update in Cursor settings
3. Verify functionality
4. Revoke old key
5. Document rotation
1---2name: 2056-security-best-practices-54de9b2e3description: Security Best Practices4---5# Security Best Practices67## Security Best Practices89### Secure Storage10```11DO:12- Use environment variables13- Use secrets managers14- Encrypt backup files15- Restrict file permissions1617DON'T:18- Hardcode in settings.json19- Commit to version control20- Share in plain text21- Use in screenshots22```2324### File Permissions25```bash26# Secure settings file27chmod 600 ~/.config/Cursor/User/settings.json2829# Verify permissions30ls -la ~/.config/Cursor/User/settings.json31# Should show: -rw------- (owner read/write only)32```3334### Key Rotation35```36Regular rotation schedule:37- Development keys: Every 90 days38- Production keys: Every 30 days39- After any potential exposure: Immediately4041Rotation process:421. Generate new key from provider432. Update in Cursor settings443. Verify functionality454. Revoke old key465. Document rotation47```
Run npx skillmds@latest add tools-only/2056-security-best-practices-54de9b2e in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Security Best Practices It is listed under Security on SkillMD.
This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
tools-only (@tools-only) published this skill. Their other Agent Skills are listed on their SkillMD profile.
tools-only