I audited 50 projects built with Cursor & Claude. Here are the 4 security traps they all had

A developer audited 50 projects built with Cursor and Claude and found four recurring security traps, including webhook token comparisons using `===` instead of constant-time comparisons. In response, the developer released an open-source MIT-licensed repo called secure-code that injects drop-in security and performance rules into `.cursorrules`, `CLAUDE.md`, and Copilot configurations across TypeScript, Python, Go, Rust, and six other languages via an npx command.

I’ve been using Cursor daily for months. It’s easily 5x'd my velocity. But if you look closely at the code it generates when you're moving fast, it has massive blindspots. It prioritizes "making the code run" over "making the code production-ready." The most common things I kept catching it doing: token === secret on webhooks instead of constant-time comparisons. The problem is that during long chat sessions, Cursor forgets system prompts unless you ground it with strict mathematical invariants. So I put together an open-source repo called secure-code with drop-in rules for Cursor .cursorrules , Claude CLAUDE.md , and Copilot across TypeScript, Python, Go, Rust, and 6 other languages. You don't need to clone the repo or install anything. You can just run this in your project terminal: npx github:carbonthecoder/secure-code inject It detects what language you’re using, finds your .cursorrules , and safely appends the security & performance constraints at the bottom without touching your existing prompt. Repo is 100% open-source MIT: https://github.com/carbonthecoder/secure-code https://github.com/carbonthecoder/secure-code Curious if anyone else has caught Cursor introducing these same patterns?