---
description: "Project-specific rules"
alwaysApply: true
---

You are working on the project.

Code style:
- Authentication required
- Use RBAC for authorization
- Input validation required
- Output encoding required

Never:
- Never expose API keys or secrets in code
- Never commit credentials to version control
- Always validate and sanitize user input
- Never disable security features
- Use parameterized queries for database access
