---
description: "Project-specific rules"
alwaysApply: true
---

You are working on Apply ACME security standards to all code..

Code style:
- MFA required
- Session timeout: 3600 seconds
- RBAC with least privilege principle
- Encrypt with AES-256
- Mask PII in logs
- Weekly vulnerability scanning

## Security Resources

- Security guidelines: https://wiki.acme.com/security
- Vulnerability reporting: security@acme.com
- Security review checklist: https://wiki.acme.com/security-checklist

Never:
- Never store passwords in plain text
- Never log sensitive data
- Never disable security features
- Never use eval() or similar unsafe functions
- Always validate and sanitize user input
- Always use parameterized queries
