{
  "id": 7867460,
  "title": "Scoped Cursor Rules for Next.js App Router: Conventions, Server Actions, and Security",
  "url": "https://urgent.news/2026/09/16/scoped-cursor-rules-for-next-js-app-router-conventions-server-actions",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-16T20:04:57.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/vildandenai/scoped-cursor-rules-for-nextjs-app-router-conventions-server-actions-and-security-413l"
  },
  "original_language": "en",
  "account": "This article describes three Cursor rules for a Next.js App Router project designed to provide convenient reminders and enforce best practices, rather than striving to make the code autonomous. The rules are: app-conventions.mdc, server-actions.mdc, and security-boundaries.mdc.\n\nThe first rule, app-conventions.mdc, applies to files in the app/ directory and components/ subdirectory. It outlines conventions for organizing route UI, loading states, error boundaries, defaulting to Server Components, using `use client` judiciously, reusing existing components, and adhering to the project's path layout. The rule does not force Server Components exclusively but encourages starting with them and marking exceptions. It also advises preserving loading, empty, and error states when modifying routes. The globs line specifies which files are affected, and the alwaysApply field is false to enable toggling.\n\nThe second rule, server-actions.mdc, targets Server Actions and route handlers, aiming to treat them as public server boundaries. It emphasizes validating all input data, including form data, JSON parameters, and search params before processing them. Server-side authentication and authorization should be implemented, with client-side checks limited to UX. Database and secret-accessing calls should reside within server-only modules. The responses must contain safe data structures, avoiding stack traces or private fields in client payloads. Idempotent mutations should be employed where possible, and focused tests for authorization and invalid input should be added when modifying mutations.\n\nThe third and final rule, security-boundaries.mdc, applies to all files in the project. It advises against placing secrets, private tokens, or privileged SDK calls within client components. Public values should only use `NEXT_PUBLIC_*`. Server-side authorization is mandatory for every protected read and mutation. All request data, cookies, headers, URL parameters, and third-party responses should be treated as untrusted. This rule aims to keep security considerations front and center within files, assisting developers in maintaining a secure codebase.",
  "summary": "A Cursor rule that applies to every file is easy to write and surprisingly easy to ignore. In a Next.js App Router project, a convention for app/ is useful while editing route code, a server-action reminder belongs near mutations, and a security checklist should be visible at server boundaries. Those are different contexts, so they should not be one oversized instruction file. This tutorial…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}