I’ve been using Cursor daily for months. It’s easily 5x'd my velocity.
But if you look closely at the code it generates when you're moving fast, it has massive blindspots. It prioritizes "making the code run" over "making the code production-ready."
The most common things I kept catching it doing:
- Writing DB queries without tenant isolation (classic IDOR vulnerability).
- Doing
token === secreton webhooks instead of constant-time comparisons. - Putting third-party network fetches inside active DB transaction blocks (which kills connection pools under high load).
- Using floats for currency calculations.
The problem is that during long chat sessions, Cursor forgets system prompts unless you ground it with strict mathematical invariants.
So I put together an open-source repo called secure-code with drop-in rules for Cursor (.cursorrules), Claude (CLAUDE.md), and Copilot across TypeScript, Python, Go, Rust, and 6 other languages.
You don't need to clone the repo or install anything. You can just run this in your project terminal:
npx github:carbonthecoder/secure-code inject
It detects what language you’re using, finds your .cursorrules, and safely appends the security & performance constraints at the bottom without touching your existing prompt.
Repo is 100% open-source MIT: https://github.com/carbonthecoder/secure-code
Curious if anyone else has caught Cursor introducing these same patterns?
Top comments (1)
@carbonthecoder, these four traps are less about model intelligence than missing invariant checks: tenant scope, constant-time verification, transaction boundaries, and exact money arithmetic. I’d put those into repository-level tests or lint rules so a coding agent cannot “forget” them during a long session. Which of the four was easiest to enforce mechanically without producing noisy false positives?