Cursor security checklist
Cursor's agent edits your real codebase and can run commands in your terminal. The risks are less about what the app does and more about what the agent does: what it deletes, installs, commits or claims.
These checks keep you in charge of the agent, so the speed does not cost you a production database or a week of work.
Approving commands you have not read
rm, reset and force commands cannot be undone.
Production credentials on your laptop
If your local settings point at production, so does every agent command.
Tests deleted to make them pass
All green can mean the tests that failed are gone.
Packages that do not exist
An invented package name can be registered by an attacker.
The same bug 'fixed' again and again
A fix loop means the agent is guessing; stop and find the cause.
Keys pasted into the chat
Anything in the chat can end up in code, logs or history.
Work lost to a force push
Force pushing rewrites history, including other people's work.
Run the free checks
Two of the most common leaks take under a minute to check. No sign-up.