Originally published on ReclaimLLM: https://reclaimllm.com/blogs/cursor-security-checklist

Privacy mode, sandbox.json, hooks with failClosed, MCP review, rules and audit: a 10-point Cursor security checklist for teams, with what each setting misses.

Cursor security checklist for engineering teams: 10 settings to check before rollout

Executive summary

• A 10-point admin checklist (Privacy Mode, sandbox, network policy, hooks, MCP review, rules, audit) for Cursor Teams/Enterprise rollouts.
• Each setting includes where it lives, the default, and what it misses—including that .cursorignore and rules are guidance, not enforcement.
• Cursor offers failClosed for security-critical hooks; ReclaimLLM’s installer does not set it—env DLP still fail-closes recognized .env access when the hook runs; crash/timeout uses Cursor’s default fail-open.
• Privacy Mode limits training/retention; it does not stop a secret being sent in a prompt.

To secure Cursor for a team: enforce Privacy Mode, turn on the agent sandbox with a deny-by-default network policy, add hooks for shell, MCP, and file reads (and set failClosed where you accept downtime if a hook breaks), review MCP servers, and keep an audit trail of what agents read. Cursor gives admins more knobs than a single ignore file—but each knob has a documented blind spot.

Use this checklist before client code lands in Cursor Teams or Enterprise. For how ReclaimLLM complements Cursor, start at Cursor security.

The 10-point Cursor security checklist

Review the table first, then work through each row with your platform and security leads.

#	Setting	Where	What it misses
1	Privacy Mode enforced for the team	Team admin / dashboard	Does not stop a secret pasted into a prompt
2	Sandbox enabled (workspace mode)	sandbox.json / team policy	type: "insecure_none" disables sandbox entirely
3	networkPolicy.default: "deny" + allowlist	sandbox.json	Applies to sandboxed commands only
4	readBoundary: "workspace"	sandbox.json (Cursor 3.23+)	Default "system" is wider; sandbox does not replace hook DLP
5	Hooks: beforeShellExecution, beforeMCPExecution, beforeReadFile, beforeSubmitPrompt	.cursor/hooks.json or team dashboard	Hook process crash/timeout fails open unless failClosed: true
6	failClosed: true on security-critical hooks	Per-hook definition	Blocks work if the hook breaks—choose per hook
7	MCP allowlist and token hygiene	.cursor/mcp.json	Tokens in config; third-party server behavior
8	.cursorignore for noise, not secrets	Repository	Not a security boundary—see why .cursorignore is not DLP
9	Rules (.cursor/rules) for guidance only	Repository	Rules are prompts, not enforcement (Knostic research on rule following)
10	Audit trail + coverage alerts	ReclaimLLM backend	Detection is after the fact unless hooks block

1. Privacy Mode enforced for the team

Cursor’s data use page and security page describe Privacy Mode: when enabled, Cursor states that your code is not used for training and that retention is limited.

What it misses

Privacy Mode does not stop a developer from pasting a live API key into chat. Requests still route through Cursor’s backend. Privacy Mode is a data handling control, not secret prevention.

2–4. Sandbox and network policy

Cursor’s sandbox reference defines how agent shell commands run:

• Set sandbox type to a workspace mode—not "insecure_none", which disables isolation.
• Use networkPolicy.default: "deny" and an explicit allowlist so outbound traffic is blocked by default inside the sandbox.
• Set readBoundary: "workspace" (Cursor 3.23+) instead of the default "system" if you want filesystem reads limited to the workspace for sandboxed commands.

Team-admin policies layer on top of repo sandbox.json and cannot be weakened by local files—verify what your plan exposes in the admin console before rollout day.

What they miss

Built-in agent file tools and unsandboxed paths may still reach sensitive files. Pair sandbox policy with beforeReadFile hooks and permission hygiene. Extension-based attacks (for example malicious VS Code extensions targeting credentials, as LayerX CursorJacking research describes—credential theft via rogue extensions—not something sandbox.json alone fixes).

5–6. Hooks: the enforcement point (and failure modes)

Cursor hooks run before shell execution, MCP calls, file reads, and prompt submit. Cursor documents that crashes, timeouts, and non-zero exit codes other than 2 fail open by default: Cursor logs the failure and allows the action through. Setting failClosed: true blocks the action when the hook fails; Cursor recommends that for security-critical beforeMCPExecution hooks.

Team and enterprise customers can manage hooks from the dashboard so every machine gets the same policy.

Cursor’s hook surface is larger than the four events in the checklist—tab and lifecycle hooks exist in agent security docs; the four before* hooks are the ones that gate shell, MCP, filesystem reads, and prompt submission. Document which events you gate.

How ReclaimLLM uses Cursor hooks

rclm-hooks-install --cursor writes .cursor/hooks.json (Cursor capture announcement). Cursor transcripts are the capture source of truth for session review. The egress guard covers Cursor shell exfiltration; AD-015 flags external egress anomalies afterward.

Env DLP when the hook runs: recognized .env and *.env reads are sanitized or denied; shell dumps of env files are blocked; DLPRedactionError denies the action—fail-closed for that class of access.

When the hook process fails: ReclaimLLM does not set failClosed on any of its eighteen injected Cursor hooks, so Cursor’s default fail-open applies on crash or timeout. You can set failClosed on hooks you own, and you may want it on MCP hooks you operate. Monitor coverage AD-010–013; coverage is detection, not MDM. See AI DLP coverage without MDM.

Local ambient redaction remains string replacement plus folder exclusion; direct env-file reads redact all assignments in the sanitized copy.

7. MCP in Cursor

Treat .cursor/mcp.json like any secrets file: approved servers only, no long-lived tokens in JSON, rotate anything that ever leaked. Industry write-ups on MCP gateways discuss the pattern neutrally; your baseline is still review plus hooks on beforeMCPExecution.

Link forward to MCP security for coding agents for a cross-IDE MCP program.

8–9. Rules and .cursorignore are guidance, not guardrails

.cursorignore reduces noise in context; it does not reliably block agent reads when a user or rule asks for a path—see why .cursorignore is not DLP.

.cursor/rules steer the model; they are not enforced permissions. Research shows agents may ignore written rules under pressure or conflicting instructions.

Shared env-file practices: prevent API keys in .env from reaching AI tools.

10. Evidence: what to keep for audits

Cursor admins need proof after the fact:

• Sessions with tool timelines and sensitive-content badges.
• Sensitive file access reviews and project-scoped file lineage on Paid and Enterprise plans.
• Email alerts (AD-004) with zero-exfiltration bodies when sensitive files are touched without DLP coverage.
• Audit log export for admin actions (audit evidence for AI coding tools when you prepare SOC-style reviews).

ReclaimLLM data residency options are US and EU; SOC 2 Type II is targeted for early 2027.

Network controls: stopping AI agent network exfiltration. Install details: native hooks.

Rolling the checklist out in a 10–100 person team

A practical sequence that avoids boiling the ocean:

1. Week 1: Enforce Privacy Mode and publish the sandbox.json template (deny network, readBoundary: "workspace", no insecure_none).
2. Week 2: Deploy hooks org-wide; run rclm-hooks-install --repair on any machine that fails coverage check-in.
3. Week 3: MCP inventory—export .cursor/mcp.json from a sample of repos and scrub tokens; approve a server list.
4. Week 4: Wire AD-004 alerts to on-call; export audit CSV into your next customer review.

Assign a single DRI (directly responsible individual) from platform engineering so security is not guessing which Cursor settings apply—see shadow AI coding tools CISO checklist if multiple agents share the same laptops.

Recommended defaults vs status quo

Control	Default / common drift	Recommended for corp code
Privacy Mode	Not enforced	Enforced for the team
Sandbox type	insecure_none on corp machines	Workspace mode
Network policy	Often permissive	default: "deny" + minimal allowlist
readBoundary	"system"	"workspace" where Cursor ≥ 3.23
Hook failure	Fail open	failClosed: true on MCP hooks you operate
.cursorignore	Treated as DLP	Hooks + deny patterns for secrets

Is Cursor secure enough for client code?

Cursor can meet many enterprise bars when Privacy Mode, sandbox network policy, hooks (with explicit fail-closed choices), MCP hygiene, and audit evidence are all in place. Cursor aligns with the same OWASP LLM themes as other coding agents: LLM02 when files or prompts carry secrets, LLM06 when sandbox or hooks are loose, and LLM09 when .cursorignore is mistaken for enforcement. Your checklist answers auditor questions with settings names and owners.

Next step: See which Cursor sessions read secrets—start free.

FAQ

Is Cursor secure for enterprise code?

It can be, with enforced Privacy Mode, sandbox and network policy, hooks, MCP hygiene, and audit evidence.

What does Cursor Privacy Mode protect?

Training/retention limits and provider ZDR arrangements as described by Cursor—it does not prevent a secret pasted into a prompt from being sent.

Does .cursorignore stop Cursor reading secrets?

No. It is not a documented security boundary for agent reads. Use hooks, sandbox boundaries, and secret hygiene—see why .cursorignore is not DLP.

Do Cursor hooks fail open or closed?

Hook process crash, timeout, or most non-2 exits: fail open unless failClosed: true. Env DLP when the hook runs: recognized .env access is fail-closed (sanitize, block dumps, or deny). ReclaimLLM’s installer does not set failClosed by default—add it on hooks you control if you want crash fail-closed.

How do I control MCP servers in Cursor?

Maintain an allowlist, keep tokens out of .cursor/mcp.json, use beforeMCPExecution hooks with failClosed where appropriate, and review third-party servers like any external integration.

---

Originally published at https://reclaimllm.com/blogs/cursor-security-checklist