Cursor is an editor, not an app builder with hosting; stack, hosting and database rules are whatever the developer and the generated project choose.
Cursor is an AI code editor and agent. It does not choose your stack or host your app; it writes code into your project and, with your approval, runs commands. Terminal commands need approval by default, .env files are ignored by default, and network access from agents is limited.
Testing a Cursor-built app is testing the app, not the editor: whatever stack the project uses is where the patterns live. The patterns listed here are the ones that appear in generated code across stacks, plus two documented Cursor issues that matter if you let the agent open untrusted content.
Each row is taken from the vendor's documentation on the date shown. Defaults change; the date is the claim.
| Area | Default | Source |
|---|---|---|
| Frontend | Cursor is an editor and agent; it does not choose a stack. The docs describe it as a coding agent for understanding codebases, planning features, fixing bugs and reviewing changes. | docs · verified 2026-09-21 |
| Hosting | Cursor does not host or deploy apps; code runs locally or where the developer deploys it. Terminal changes execute immediately on disk. | docs · verified 2026-09-21 |
| Command approval | By default terminal commands need your approval; file reading and code search do not. Run Modes range from an allowlist to an Auto-review classifier, described as best-effort guardrails rather than a hard boundary. | docs · verified 2026-09-21 |
| Secrets / env vars | .env* files are ignored by default, along with node_modules, .git, lock files and media, so Agent, Tab and Inline Edit do not read them. | docs · verified 2026-09-21 |
| Network access | Agents cannot make arbitrary network requests by default; permitted destinations include GitHub, direct link retrieval and web search providers. | docs · verified 2026-09-21 |
| Source access | Code stays in the developer's repository; with Privacy Mode enabled, customer data is not used for training and model providers operate under zero data retention agreements. | docs · verified 2026-09-21 |
Documentation home: cursor.com/docs
52 patterns in the catalogue name Cursor; the most severe are listed here across secrets and keys, data access, login and permissions, payments. Attribution is descriptive: the default stack makes the pattern reachable, or a public incident names it.
The build writes the secret's value into public JavaScript, so anyone who loads the site can read it, and a redeploy with the same variable name republishes it.
Everyone who can see the repository, now or later, holds working keys to the database, payment account and model provider, and the keys stay in history after the file is deleted.
Anyone who opens the app can copy the key from the downloaded JavaScript and read, change or delete every row in every table.
Anyone with the app's public Firebase config, which sits in its JavaScript, can read, overwrite or delete the entire database and storage bucket without signing in.
Anyone who changes the id in a URL or request can read, edit or delete another customer's record.
Signed-out visitors or other customers can read rows meant for one account, while the owner sees an empty page and nobody notices.
Anyone who creates a free account can page through every other customer's records, which is a data breach with a sign-up form as the only step.
Anyone with the project URL and the public anon key, both of which sit in the app's JavaScript, can read, edit or delete every row in the table.
The table looks protected in the dashboard, yet any visitor with the public anon key can read, insert, update and delete every row.
A stranger who types /admin or /api/admin into the address bar can see or change everything the owner can.
Anyone who calls the API directly, or edits the page in developer tools, gets the data and actions the screen was hiding.
Anyone who reads the code or guesses a common placeholder can sign in as the administrator.
Anyone can write their own token naming another user, or an admin, and the server will act as that person.
A visitor who edits the signup request, or updates their own profile, can make themselves an admin.
Anyone who finds the webhook URL can post a made-up payment-succeeded event and get an order fulfilled or a plan activated for a user of their choosing, without paying.
Two days after announcing a SaaS built with Cursor and no hand-written code, its founder reported subscription bypasses, maxed-out API keys and unwanted database writes; he shut the app down three days later.
Mar 2025 · Leo (Enrichlead founder) · all sources
Cursor below version 1.3.9 created workspace files without approval, so a prompt injection in content the agent read could write a .cursor/mcp.json file and run attacker commands (CVE-2025-54135, CVSS 8.6).
Aug 2025 · CVE Program (GitHub CNA) · all sources
In Cursor versions before 1.3, an MCP server configuration approved once could later be changed to a different command, for example in a shared repository, and would run without a new prompt (CVE-2025-54136, CVSS 7.2).
Aug 2025 · CVE Program (GitHub CNA) · all sources
Lovable reported that from 3 February to 20 April 2026 a backend regression let any logged-in Lovable user read the chat history and source code of public projects; a fix shipped within two hours.
Apr 2026 · Lovable · all sources
Each entry links to its primary source in the evidence list. What to do about it is the self-check below.
Stated from the vendor's documentation. The limits are the vendor's scope statements, not judgements.
Privacy Mode
When enabled, Cursor does not train on your data and applies technical and contractual controls with model providers; available to all users.
Where it stops: Providers may still run abuse classifiers, and flagged prompts may be stored for investigation, per the privacy overview.
vendor docs · verified 2026-09-21
Sandboxed terminal (Run Modes)
Sandboxing runs shell commands with read and write access inside the workspace and network blocked by default, using Seatbelt on macOS and Landlock plus seccomp on Linux (kernel 6.2+). Auto-review is the recommended default since Cursor 3.6.
Where it stops: Some commands need full system access and bypass the sandbox; the classifier can allow a call you would have blocked.
vendor docs · verified 2026-09-21
.cursorignore
Blocks listed files from Agent, Tab, Inline Edit and @ mentions; .env* files are ignored by default.
Where it stops: Terminal and MCP server tools used by Agent cannot be blocked by .cursorignore.
vendor docs · verified 2026-09-21
Bugbot
Reviews pull request diffs for bugs, security issues and code quality problems and leaves comments with fix suggestions.
Where it stops: Usage-based billing; Cursor project rules in .cursor/rules do not apply to Bugbot runs.
vendor docs · verified 2026-09-21
The critical patterns first. Each uses the dashboard and your browser.
.env files, list every variable whose name starts with NEXT_PUBLIC_.NEXT_PUBLIC_ variable holding a server-only key, or a search hit for that key's value in a loaded script..env, .env.local, .env.production, serviceAccountKey.json or firebase-adminsdk files.sk_live, sk-, service_role, BEGIN PRIVATE KEY and password=.git log --all -p -S sk_live -- . | head. Any output means a live key has been committed at some point.service_role and then for sb_secret_.supabase.co, and read the apikey header under Request Headers.Cursor pre-launch checklist
52 checks, in the order we run them. Usable without buying anything.
Self-check tool
Answer questions about your app and get the patterns that apply, ordered by severity. Runs in your browser; nothing is sent.
For founders about to let real users in.
$490
For anyone who wants the three riskiest areas checked fast.
$290
All packages and prices. Every report includes a re-check after your fixes.
We review the generated code and test the running app: permission checks on every route, secrets handling, database rules, payment logic and error handling. Cursor's Bugbot reviews pull requests; an independent test adds a second account and a running attacker's view.
No editor can promise that. Studies on the evidence page found AI-written changes carried more security issues than human ones in the samples measured. The practical answer is to test the flows that move money or personal data before launch and to keep tests running in CI.
Cursor documents Privacy Mode, sandboxed terminal run modes and .cursorignore. Two 2025 CVEs concerned prompt injection into the agent's tooling and were fixed in versions 1.3 and 1.3.9; keep Cursor updated and review MCP servers before approving them.