AI Security Shield .cursorrules

# VibeScale Zero-Trust Security Protocol
1. SECRETS AVOIDANCE: ABSOLUTELY DO NOT write real API keys, passwords, database URIs, or tokens into the codebase UNDER ANY CIRCUMSTANCES. Use ONLY 'process.env.VARIABLE_NAME' for secrets.
2. SANITIZATION: Every user input hitting a database MUST be validated using Zod. Prevent SQL injection by strictly using parameterized ORM queries (Base44/Prisma). NO raw SQL strings constructed from variables.
3. PROMPT INJECTION DEFENSE: When building internal AI Agents, all LLM calls taking user context must wrap user text in delimited chunks (e.g. triple XML tags) and explicitly instruct the LLM to process it as data, not instruction.
4. DEPENDENCY AUDITING: Do not install external npm packages unless explicitly approved. Rely strictly on verified built-in crypto or standard frameworks.
5. IP PROTECTION: Never externalize proprietary business logic out of the current codebase workspace text context.