How to use it
- Once at setup, work through sections A to G.
- Fix every P1 item before doing any work on company code. P2 items close important gaps; P3 items are good practice.
- Items with an audit check ID are verified automatically by the Cursor Security Audit. Re-run it monthly and after every Cursor upgrade. Items without one are confirmed by hand.
- Keep the completed checklist with your saved audit report as your assessment record.
A. Installation and identity
| # | Check | Priority | Audit check |
|---|---|---|---|
| A1 | Cursor is 3.1.2 or later (CVE-2026-73217), and updates are installed when offered. | P1 | I01 |
| A2 | Work code runs under your organisation's Teams or Enterprise account, so its policies apply. | P1 | manual |
| A3 | Privacy Mode is on, or enforced by the team, for company code. | P2 | manual |
| A4 | On Windows, C:\ProgramData\Cursor exists and only administrators can write it. | P1 | W01, W02 |
B. Run mode and sandbox
| # | Check | Priority | Audit check |
|---|---|---|---|
| B1 | The run mode is Auto-review, or Allowlist with the sandbox on; never Run Everything on a machine with credentials. | P1 | manual |
| B2 | Workspace Trust is on (security.workspace.trust.enabled); it ships disabled. | P1 | V02 |
| B3 | ~/.cursor/sandbox.json keeps type at workspace_readwrite or workspace_readonly, never insecure_none. | P1 | B01 |
| B4 | Sandbox network is denied by default with a short allow list, and the network mode is "sandbox.json Only". | P1 | B02, B03 |
| B5 | No extra sandbox paths cover your home folder or credential folders. | P2 | B04 |
| B6 | On Windows, the agent runs inside WSL2 so the sandbox applies. | P2 | manual |
C. Allowlists, hooks and the CLI
| # | Check | Priority | Audit check |
|---|---|---|---|
| C1 | The terminal allowlist holds only read-only commands, with no shells, interpreters, deletes or network tools. | P1 | A01 |
| C2 | No *:* or whole-server MCP allowlist entries. | P2 | A02 |
| C3 | Auto-review block_instructions cover credentials, deletes, pushes and outbound data. Read them by hand: the audit lists them under A03 but can't judge what they cover. | P3 | manual |
| C4 | No user hook downloads or runs remote code, and security hooks set failClosed: true. | P2 | H01, H02 |
| C5 | The Cursor CLI uses allowlist or auto-review approval with its sandbox on, and denies Read(**/.env*). | P1 | L01, L02, L03, L04 |
| C6 | No alias adds --yolo, --force, --sandbox disabled or --approve-mcps. | P1 | S01 |
D. Extensions: MCP servers and extensions
| # | Check | Priority | Audit check |
|---|---|---|---|
| D1 | Every MCP server is approved and pinned to a version. | P1 | M01, M03 |
| D2 | Servers that read content outsiders write (errors, tickets, chat, email) have read-only scopes. | P2 | M02 |
| D3 | MCP secrets are passed as ${env:NAME}, never written into mcp.json. | P2 | M04 |
| D4 | Extensions come only from your organisation's allowlist and verified publishers. | P2 | manual |
E. Repositories
| # | Check | Priority | Audit check |
|---|---|---|---|
| E1 | Before trusting a folder, its .cursor/sandbox.json and permissions.json are read: they widen yours. | P1 | P01, P02 |
| E2 | Project MCP servers, hooks and CLI permissions are reviewed. | P1 | P03, P04, P05, P06, P07, P08 |
| E3 | Rules files (.cursor/rules/, .cursorrules, AGENTS.md, CLAUDE.md) are read and checked for hidden Unicode. | P1 | P09, P10 |
| E4 | environment.json and worktrees.json setup commands are reviewed. | P2 | P11 |
| E5 | Symlinks are listed and none points at .cursor/ or a dotfile. | P1 | P13 |
| E6 | Repositories that arrive with their own .git/config are checked for core.hooksPath, core.fsmonitor and filter drivers. | P2 | P14 |
| E7 | .env files are gitignored, and .cursorignore isn't relied on to hide secrets. | P2 | P12 |
F. Cloud agents and Bugbot
| # | Check | Priority | Audit check |
|---|---|---|---|
| F1 | Cloud agent network access is "Default + allowlist" or "Allowlist only", not "Allow all". | P1 | manual |
| F2 | Cloud agent environments hold only the secrets a task needs, since secrets are visible through the terminal. | P1 | manual |
| F3 | The GitHub connection covers only the repositories Cursor needs, and branch protection stops agents merging. | P1 | manual |
| F4 | Bugbot autofix is off or limited to new branches. | P2 | manual |
G. Working habits
| # | Check | Priority | Audit check |
|---|---|---|---|
| G1 | Instruction-like text in issues, pull requests, web pages and MCP results is read by a person before the agent acts on it. | P1 | manual |
| G2 | Changes to .cursor/, rules files and .git/ are treated as security events. | P1 | manual |
| G3 | No production credentials in the environment Cursor runs in. | P1 | manual |
| G4 | Secret scanning, SAST and SCA run on every pull request, and a person reviews every AI-authored change. | P1 | manual |
| G5 | Suspicious agent behaviour is reported to the security team the same day. | P2 | manual |
Sources
- Cursor documentation: Agent security, Run modes, sandbox.json, permissions.json, Hooks, MCP, CLI permissions, Cloud agent security.
- Incidents behind sections D and E: see the Common Cursor Misconfigurations.
Informational only, with no guarantee of a vulnerability-free setup, so test every configuration in your own environment. AISecurityLabs.org is independent and not affiliated with Anysphere. Settings change as Cursor evolves, so check them against the docs for your version.