AI SECURITYLABS

Security for Cursor Development: Configure the sandbox

Part 9 of 16

Configure the sandbox

The sandbox uses Seatbelt on macOS and Landlock with seccomp on Linux, and on Windows it works only through WSL2. ~/.cursor/sandbox.json controls what sandboxed commands can reach (Cursor docs):

  • Keep type at workspace_readwrite: insecure_none turns the sandbox off.
  • Deny the network by default: set networkPolicy.default to deny, list only your registries, and choose “sandbox.json Only” so Cursor’s defaults aren’t added.
  • Add no home or credential paths: extra paths widen what every sandboxed command can read or write.

The audit’s fix section has a baseline sandbox.json.