Developers are turning to AI coding assistants to save time and speed up their work. But these tools can also introduce security risks if they suggest flawed or unsafe code. To help address that, Secure Code Warrior has released a new set of free AI Security Rules on GitHub.
These rulesets offer practical guidance to help developers write more secure code when using tools like GitHub Copilot, Cursor, Cline, Roo, Aider, and Windsurf. Designed specifically for real-world AI-assisted coding, the rules aim to close the gap between fast development and secure software.
“These guardrails add a meaningful layer of defense, especially when developers are moving fast, multitasking, or find themselves trusting AI tools a little too much. We’ve kept our rules concise and strictly focused on security practices that work across a wide range of environments, intentionally avoiding language or framework-specific guidance. Our vision is a future where security is seamlessly integrated into the developer workflow, regardless of how code is written. This is just the beginning,” said Pieter Danhieux, CEO at Secure Code Warrior.
Key features and benefits
Secure default promotion: Users can establish guardrails that steer AI away from risky patterns and common security missteps, such as unsafe eval usage, insecure authentication flows or failure to use parameterized queries.
Ready to adapt and extend: Organized by development domain (web frontend, backend, and mobile), these rulesets are easy to extend and work with popular AI coding tools that support rule files.
Enhanced consistency and collaboration: Publicly available and easily adjustable, these rules can be tailored to fit any team, tech stack or workflow, helping to align AI-generated output across projects and contributors.
Usage
1. Choose your tool(s):
2. Copy the corresponding rule file into your local project:
For Copilot: Add .github/copilot-instructions.md
For Cursor: Add .cursor/rules
For Windsurf: Add .windsurfrules
For Cline: Add .clinerules
For Roo: Add .roorules
For Aider: Add in CONVENTIONS.md and add to the .aider.conf.yml config file
3. Configure metadata if needed to trigger the rules, either always or conditionally, depending on the tool.
4. Update or extend rule files to reflect your own security and development policies.
5. Once set up, your AI tool will automatically apply these instructions during use.