I’ve been using Cursor daily for months. It’s easily 5x'd my velocity.
But if you look closely at the code it generates when you're moving fast, it has massive blindspots. It prioritizes "making the code run" over "making the code production-ready."
The most common things I kept catching it doing:
token === secret on webhooks instead of constant-time comparisons.
The problem is that during long chat sessions, Cursor forgets system prompts unless you ground it with strict mathematical invariants.
So I put together an open-source repo called secure-code with drop-in rules for Cursor (.cursorrules), Claude ( CLAUDE.md), and Copilot across TypeScript, Python, Go, Rust, and 6 other languages.
You don't need to clone the repo or install anything. You can just run this in your project terminal:
npx github:carbonthecoder/secure-code inject
It detects what language you’re using, finds your .cursorrules, and safely appends the security & performance constraints at the bottom without touching your existing prompt.
Repo is 100% open-source MIT: https://github.com/carbonthecoder/secure-code Curious if anyone else has caught Cursor introducing these same patterns?