Cursor Security Patterns

About Cursor

Cursor is an AI-powered code editor built on VS Code. It is one of the most popular tools for vibe coding, offering composer and chat features that let developers describe what they want and have AI generate the code.

Cursor supports multiple AI models including Claude, GPT-4, and others. While it is a powerful productivity tool, like all AI coding assistants, it generates code patterns that prioritize functionality over security. The common vulnerabilities align with categories in the OWASP Top 10, particularly A03:2021 Injection and A07:2021 Identification and Authentication Failures.

Security Patterns

These are the most common security issues we see in Cursor-generated code:

// Cursor often generates this:
const getUser = async (userId) => {
  const result = await db.query(`
    SELECT * FROM users WHERE id = ${userId}
  `)
  return result.rows[0]
}

// Secure version:
const getUser = async (userId) => {
  const result = await db.query(
    'SELECT * FROM users WHERE id = $1',
    [userId]
  )
  return result.rows[0]
}

// Cursor might generate:
const pool = new Pool({
  connectionString: 'postgresql://admin:password123@localhost:5432/mydb'
})

// Secure version:
const pool = new Pool({
  connectionString: process.env.DATABASE_URL
})

// Cursor generates functional but unprotected routes:
export async function GET(request, { params }) {
  const order = await db.order.findUnique({
    where: { id: params.id }
  })
  return Response.json(order)
}

// With auth check:
export async function GET(request, { params }) {
  const session = await getServerSession(authOptions)
  if (!session) {
    return Response.json({ error: 'Unauthorized' }, { status: 401 })
  }
  // ... rest of handler
}

// Auth exists but no ownership check:
if (!session) return unauthorized()

const document = await db.document.findUnique({
  where: { id: params.id }  // Any document, not user's
})

// With ownership check:
const document = await db.document.findUnique({
  where: {
    id: params.id,
    userId: session.user.id  // Only user's documents
  }
})

// Client validation only:
const handleSubmit = (e) => {
  if (!email.includes('@')) {
    setError('Invalid email')
    return
  }
  // Submits to API that has no validation
  fetch('/api/users', { body: JSON.stringify({ email }) })
}

// Add server-side validation:
export async function POST(request) {
  const { email } = await request.json()

  // Server-side validation
  if (!email || !email.includes('@')) {
    return Response.json({ error: 'Invalid email' }, { status: 400 })
  }
  // ... proceed
}

Why Cursor generates these patterns

Cursor generates insecure code patterns for the same reasons all AI coding tools do:

• Training data: AI models learn from millions of code examples, many of which contain insecure patterns that are common in tutorials and Stack Overflow answers
• Readability optimization: Template literals are more readable than parameterized queries, so AI tends to generate them
• Prompt interpretation: "Create an API" does not imply "add authentication" to an AI model
• Functionality focus: AI optimizes for code that works, not code that is secure

How to use Cursor securely

1. Be explicit about security in prompts:

   Instead of "create a user API," say "create an authenticated API endpoint that only returns the logged-in user's data using parameterized queries."

2. Review generated code before committing:

   Look for template literals in database queries, missing auth checks, and hardcoded values.

3. Use AI fix prompts to refactor:

   Paste our fix prompts into Cursor to have it fix its own security issues.

4. Scan before shipping:

   Run Vibeship Scanner on your codebase to catch vulnerabilities.

Frequently asked questions

Related content