SEC378 / CURSOR-ALWAYSAPPLY-GLOBS

SEC378 flags Cursor rule markdown when frontmatter sets alwaysApply: true and also keeps a globs field.

Why It Matters

When a Cursor rule applies globally, path globs no longer narrow its scope. Keeping both fields makes targeting harder to reason about and creates needless config drift in shared rule packs.

This rule lives in the explicit guidance lane because the problem is shared-config hygiene and maintainability, not a headline exploit-style security claim.

Trigger Shape

The rule triggers only when all of these are true:

• the file is a detected Cursor rule surface
• frontmatter contains alwaysApply: true
• frontmatter also contains a globs key

Clean Cases

These stay clean:

• path-scoped rules with globs and alwaysApply: false
• global rules with alwaysApply: true and no globs
• fixture-like examples under test or fixture paths

Example Trigger

---
description: Review guidance
globs:
  - "**/*.rs"
alwaysApply: true
---

Safer Example

---
description: Review guidance
alwaysApply: true
---

How To Fix

If the rule should apply globally, remove globs. If it should stay path-scoped, switch alwaysApply to false and keep only the intended glob patterns.