--- name: "AEM" description: "Always-on rules for AEM as a Cloud Service Java bundles, HTL components, OSGi configs, front-end clientlibs and dispatcher configuration." applyTo: "**/core/src/**/*.java,**/ui.apps/**,**/ui.config/**,**/ui.frontend/**,**/dispatcher/**" --- # AEM rules Write for AEM as a Cloud Service first: immutable `/apps`, no admin sessions, auto-scaled disposable publish pods. ## HTL and components - Never use `@ context='unsafe'`. It disables XSS protection and is a review blocker. - Use the right XSS context: `context='html'` for RTE output, `'uri'` for links, `'attribute'`/`'text'` where the default is not inferred, `'scriptString'`/`'styleString'` inside `