I audited 50 projects built with Cursor & Claude. Here are the 4 security traps they all had

mohammed ibrahim — Sun, 13 Sep 2026 15:10:31 +0000

I’ve been using Cursor daily for months. It’s easily 5x'd my velocity.

But if you look closely at the code it generates when you're moving fast, it has massive blindspots. It prioritizes "making the code run" over "making the code production-ready."

The most common things I kept catching it doing:

Writing DB queries without tenant isolation (classic IDOR vulnerability).
Doing token === secret on webhooks instead of constant-time comparisons.
Putting third-party network fetches inside active DB transaction blocks (which kills connection pools under high load).
Using floats for currency calculations.

The problem is that during long chat sessions, Cursor forgets system prompts unless you ground it with strict mathematical invariants.

So I put together an open-source repo called secure-code with drop-in rules for Cursor (.cursorrules), Claude (CLAUDE.md), and Copilot across TypeScript, Python, Go, Rust, and 6 other languages.

You don't need to clone the repo or install anything. You can just run this in your project terminal:

npx github:carbonthecoder/secure-code inject

It detects what language you’re using, finds your .cursorrules, and safely appends the security & performance constraints at the bottom without touching your existing prompt.

Repo is 100% open-source MIT: https://github.com/carbonthecoder/secure-code

Curious if anyone else has caught Cursor introducing these same patterns?

DEV Community: mohammed ibrahim

I audited 50 projects built with Cursor & Claude. Here are the 4 security traps they all had