Cursor security checklist for engineering teams: 10 settings to check before rollout

Executive summary

• A 10-point admin checklist (Privacy Mode, sandbox, network policy, hooks, MCP review, rules, audit) for Cursor Teams/Enterprise rollouts.
• Each setting includes where it lives, the default, and what it misses—including that .cursorignore and rules are guidance, not enforcement.
• Cursor offers failClosed for security-critical hooks; ReclaimLLM’s installer does not set it—env DLP still fail-closes recognized .env access when the hook runs; crash/timeout uses Cursor’s default fail-open.
• Privacy Mode limits training/retention; it does not stop a secret being sent in a prompt.

To secure Cursor for a team: enforce Privacy Mode, turn on the agent sandbox with a deny-by-default network policy, add hooks for shell, MCP, and file reads (and set failClosed where you accept downtime if a hook breaks), review MCP servers, and keep an audit trail of what agents read. Cursor gives admins more knobs than a single ignore file—but each knob has a documented blind spot.

Use this checklist before client code lands in Cursor Teams or Enterprise. For how ReclaimLLM complements Cursor, start at Cursor security.

The 10-point Cursor security checklist

Review the table first, then work through each row with your platform and security leads.

| # | Setting | Where | What it misses | | --- | --- | --- | --- | | 1 | Privacy Mode enforced for the team | Team admin / enterprise policy | Data still flows to Cursor and model providers for inference; limits training/retention, not accidental prompts | | 2 | Agent sandbox on | sandbox.json / team policy | type: "insecure_none" disables sandbox entirely | | 3 | networkPolicy.default: "deny" + allowlist | sandbox.json | Applies to sandboxed commands only | | 4 | readBoundary: "workspace" | sandbox.json (Cursor 3.23+) | Default "system" is wider; sandbox does not replace hook DLP | | 5 | Hooks: beforeShellExecution, beforeMCPExecution, beforeReadFile, beforeSubmitPrompt | .cursor/hooks.json or team dashboard | Hook process crash/timeout fails open unless failClosed: true | | 6 | failClosed: true on security-critical hooks | Per-hook definition | Blocks work if the hook breaks—choose per hook | | 7 | MCP server review | .cursor/mcp.json | Tokens in config; third-party server behavior | | 8 | .cursorignore for noise, not secrets | Repository | Not a security boundary—see why .cursorignore is not DLP | | 9 | Rules (.cursor/rules) for guidance only | Repository | Rules are prompts, not enforcement (Knostic research on rule following) | | 10 | Audit trail + coverage alerts | ReclaimLLM backend | Detection is after the fact unless hooks blocked the action |

1. Privacy Mode enforced for the team

Cursor’s data use page and security page describe Privacy Mode: when enabled, Cursor states that your code is not used for training and that zero-data-retention agreements apply with model providers where supported. Team and enterprise admins can enforce Privacy Mode so new members inherit it.

What it misses

Privacy Mode does not stop a developer from pasting a live API key into chat. Requests still route through Cursor’s backend for prompt building even when you bring your own API key. Treat Privacy Mode as a data handling control, not secret prevention.

2–4. Sandbox and network policy

Cursor’s sandbox reference defines how agent shell commands run:

• Set sandbox type to a workspace mode—not "insecure_none", which disables isolation.
• Use networkPolicy.default: "deny" and an explicit allowlist so outbound traffic is blocked by default inside the sandbox.
• Set readBoundary: "workspace" (Cursor 3.23+) instead of the default "system" if you want filesystem reads limited to the workspace for sandboxed commands.

Team-admin policies layer on top of repo sandbox.json and cannot be weakened by local files—verify what your plan exposes in the admin console before rollout day.

What they miss

Built-in agent file tools and unsandboxed paths may still reach sensitive files. Pair sandbox policy with beforeReadFile hooks and permission hygiene. Extension-based attacks (for example malicious VS Code extensions targeting Cursor) are a separate class of risk; browser-style extension review still matters (LayerX CursorJacking research describes credential theft via rogue extensions—not something sandbox.json alone fixes).

5–6. Hooks: the enforcement point (and failure modes)

Cursor hooks run before shell execution, MCP calls, file reads, and prompt submit. Cursor documents that crashes, timeouts, and non-zero exit codes other than 2 fail open by default: Cursor logs the failure and allows the action through. Setting failClosed: true blocks the action when the hook fails; Cursor recommends that for security-critical beforeMCPExecution hooks.

Team and enterprise customers can manage hooks from the dashboard so every machine gets the same policy.

Cursor’s hook surface is larger than the four events in the checklist—tab and lifecycle hooks exist for other workflows—but for agent security the four before* hooks are the ones that gate shell, MCP, filesystem reads, and prompt submission. Document which events your security vendor registers so auditors do not confuse autocomplete hooks with agent enforcement.

How ReclaimLLM uses Cursor hooks

rclm-hooks-install --cursor writes .cursor/hooks.json (Cursor capture announcement). Cursor transcripts are the capture source of truth for session review. The egress guard covers Cursor shell exfiltration; AD-015 flags external egress anomalies afterward.

Env DLP when the hook runs: recognized .env and *.env reads are sanitized or denied; shell dumps of env files are blocked; DLPRedactionError denies the action—fail-closed for that class of access.

When the hook process fails: ReclaimLLM does not set failClosed on any of its eighteen injected Cursor hooks, so Cursor’s default fail-open applies on crash or timeout—even though Cursor offers failClosed and you may want it on MCP hooks you own. Monitor coverage AD-010–013; coverage is detection, not MDM. See AI DLP coverage without MDM.

Local ambient redaction remains string replacement plus folder exclusion; direct env-file reads redact all assignments in the sanitized copy.

7. MCP in Cursor

Treat .cursor/mcp.json like any secrets file: approved servers only, no long-lived tokens in JSON, rotate anything that ever appeared in a repo. MCP gateways can help centralize auth (industry write-ups on MCP gateways discuss the pattern neutrally); your baseline is still review plus hooks on beforeMCPExecution.

Link forward to MCP security for coding agents for a cross-IDE MCP program.

8–9. Rules and .cursorignore are guidance, not guardrails

.cursorignore reduces noise in context; it does not reliably block agent reads when a user or rule asks for a path. One row in the checklist is enough—details live in why .cursorignore is not DLP.

.cursor/rules steer the model; they are not enforced permissions. Research shows agents may ignore written rules under pressure—use hooks and sandbox policy for anything compliance cares about.

Shared env-file practices: prevent API keys in .env from reaching AI tools.

10. Evidence: what to keep for audits

Cursor admins need proof after the fact:

• Sessions with tool timelines and sensitive-content badges.
• Sensitive file access reviews and project-scoped file lineage on Paid and Enterprise plans.
• Email alerts (AD-004) with zero-exfiltration bodies when sensitive files are touched without DLP coverage.
• Audit log export for admin actions (audit evidence for AI coding tools when you prepare SOC-style reviews).

ReclaimLLM data residency options are US and EU; SOC 2 Type II is targeted for early 2027.

Network controls: stopping AI agent network exfiltration. Install details: native hooks.

Rolling the checklist out in a 10–100 person team

A practical sequence that avoids boiling the ocean:

1. Week 1: Enforce Privacy Mode and publish the sandbox.json template (deny network, readBoundary: "workspace", no insecure_none).
2. Week 2: Deploy hooks org-wide; run rclm-hooks-install --repair on any machine that fails coverage check-in.
3. Week 3: MCP inventory—export .cursor/mcp.json from a sample of repos and scrub tokens; approve a server list.
4. Week 4: Wire AD-004 alerts to on-call; export audit CSV into your next customer review.

Assign a single DRI (directly responsible individual) from platform engineering so security is not guessing which Cursor build is in the field. Pair this checklist with the shadow AI coding tools CISO checklist if multiple agents share the same laptops.

Recommended defaults vs status quo

| Control | Default / common drift | Recommended for corp code | | --- | --- | --- | | Privacy Mode | Per-user | Enforced at team level | | Sandbox type | Workspace mode | Never insecure_none on corp machines | | Network policy | Often permissive | default: "deny" + minimal allowlist | | readBoundary | "system" | "workspace" where Cursor ≥ 3.23 | | Hook failure | Fail open | failClosed: true on MCP hooks you operate | | .cursorignore | Treated as DLP | Hooks + deny patterns for secrets |

Is Cursor secure enough for client code?

Cursor can meet many enterprise bars when Privacy Mode, sandbox network policy, hooks (with explicit fail-closed choices), MCP review, and session evidence are owned by named admins—not when “we bought Teams seats” is the whole program. Cursor documents the mechanisms; your checklist proves they are on.

Cursor aligns with the same OWASP LLM themes as other coding agents: LLM02 when files or prompts carry secrets, LLM06 when sandbox or hooks are loose, and LLM09 when .cursorignore is mistaken for enforcement. Your checklist answers auditor questions with settings names and owners—not with “we trust the vendor.”

Next step: See which Cursor sessions read secrets—start free.

FAQ

Is Cursor secure for enterprise code?

It can be, with enforced Privacy Mode, sandbox and network policy, hooks, MCP hygiene, and audit evidence. Like any agent IDE, it depends on configuration and monitoring.

What does Cursor Privacy Mode protect?

Training/retention limits and provider ZDR arrangements as described by Cursor—it does not prevent intentional or accidental secret paste into prompts.

Does .cursorignore stop Cursor reading secrets?

No. It is not a documented security boundary for agent reads. Use hooks, sandbox boundaries, and secret storage practices; see why .cursorignore is not DLP.

Do Cursor hooks fail open or closed?

Hook process crash, timeout, or most non-2 exits: fail open unless failClosed: true. Env DLP when the hook runs: recognized .env access is fail-closed (sanitize, block dumps, or deny). ReclaimLLM’s installer does not set failClosed by default—add it on hooks you control if you want crash fail-closed.

How do I control MCP servers in Cursor?

Maintain an allowlist, keep tokens out of .cursor/mcp.json, use beforeMCPExecution hooks with failClosed where appropriate, and review third-party servers like any external integration.