Blog · 43 posts
Security notes for people shipping with AI.
Guides, comparisons and the mistakes we see most in AI-built apps.
Security · Oct 14, 2026Why Cursor Stores Supabase Admin Roles in user_metadataAI editors often store a Supabase user's role in user_metadata and check it in RLS policies and middleware. Any signed-in user can rewrite that field with one updateUser call. Here is where the role should live instead, and a two-minute test.6 min readSecurity · Oct 13, 2026Why Cursor Ships Your OpenAI Key to Every Visitor (CWE-522)AI editors fix the OpenAI SDK browser error with dangerouslyAllowBrowser and a VITE_ or NEXT_PUBLIC_ key, publishing it to every visitor. The fix, plus a bundle check.6 min readSecurity · Oct 12, 2026Why Cursor Stripe Webhooks Accept Fake Payments (CWE-345)AI editors silence the Stripe signature error by making verification optional, so anyone can POST a fake checkout event and get a paid plan. The fix for Next.js, Express and Python.6 min readSecurity · Oct 11, 2026Why Cursor Fixes Supabase RLS Errors by Opening the TablePaste a Supabase "new row violates row-level security policy" error into an AI editor and the usual fix is USING (true) or disabling RLS, which makes the table public. Here is the owner-scoped policy that actually fixes it, and a one-minute test.6 min readSecurity · Oct 10, 2026Why Cursor Decodes JWTs Instead of Verifying Them (CWE-347)AI editors often fix a Next.js middleware build error by swapping jwt.verify() for jwt.decode(), so any user can forge an admin token. Here is why it happens and the fix for Node, Edge and Python.6 min readSecurity · Oct 8, 2026Why Cursor Lets Any User Make Themselves Admin (CWE-915)AI editors write update routes that save the whole request body, so any user can set role to admin. The fix they suggest is a denylist that misses the rest. Here is the allowlist fix in zod and Pydantic.6 min readSecurity · Sep 11, 2026AI Security Patches Fail 74% of the Time: 6,080 Tested1Password's Off-by-1 Labs had ChatGPT 5.5 and Claude Opus 4.8 write 6,080 patches for six real CVEs. Only 26.0% were complete fixes that preserved application behavior. Here is the failure mode, in code you will recognize.8 min readSecurity · Sep 8, 2026GitSpawn: Claude Code Runs Untrusted Repo Code Before You TypeA repository sent to you as a zip can run commands on your machine the moment you open it with Claude Code, Cursor or Codex. Here is how GitSpawn works, what is still unpatched, and the one check that actually stops it.7 min readSecurity · Aug 27, 2026CVE-2026-35603: Cursor Still Trusts a World-Writable FolderClaude Code, Cursor, Codex CLI and Gemini CLI on Windows all load machine-wide config from a ProgramData folder any standard user can write to. Anthropic fixed it and got CVE-2026-35603 assigned. Three of the four vendors had not fixed it at disclosure.6 min readSecurity · Aug 19, 2026Slopsquatting: Why Cursor Recommends Packages Attackers OwnAI editors invent package names and attackers register them. Your dependency scanner reports zero findings because a package published three weeks ago has no CVE history. Here is the five-second check that actually catches slopsquatting.4 min readSecurity · Aug 16, 2026The Command Injection Fix Cursor Writes Still Runs Code (CWE-78)Ask Cursor to fix a command injection bug and it writes a regex blocklist of shell metacharacters. The payload that defeats it, git clone ext::sh -c, contains none of them and still runs code on your machine. Here is why blocklists fail for CWE-78 and the three-part fix that holds.6 min readSecurity · Aug 13, 2026Agentjacking: Your Sentry DSN Lets Attackers Hijack CursorAttackers can inject commands into Cursor and Claude Code by POSTing fake error events to your Sentry project using the public DSN in your JavaScript bundle. Tenet Security found 2,388 exposed organizations and an 85 percent hijack success rate. Here is the attack and the fix.6 min readSecurity · Aug 12, 2026The IDOR Fix Cursor Writes Stops at the GET Route (CWE-639)Ask an AI editor to fix an IDOR and it scopes the GET route to the current user, correctly, then leaves PATCH, DELETE and the list endpoint on primary-key lookups. The unscoped list endpoint is the worse half.11 min readSecurity · Aug 9, 2026The Path Traversal Fix Cursor Writes Ignores Symlinks (CWE-22)Ask an AI editor to fix a path traversal bug and it writes path.resolve plus a containment check. That check is pure string math, it never touches the disk, and a symlink inside your upload directory walks straight through it.8 min readSecurity · Aug 8, 2026The SSRF Fix Cursor Writes Is Still Vulnerable (CWE-918)Ask an AI editor to fix an SSRF and it writes a DNS lookup, an IP range check, then fetch. That check does not hold, because Node resolves the hostname again at connect time and DNS rebinding walks straight past it.7 min readSecurity · Aug 6, 2026Cursor Learned to Code From Tutorials That Skip SecurityAI editors learned to code from tutorials, and tutorials cut security controls on purpose because every control is invisible on success. That is why Cursor writes SQL injection it can correctly identify ninety seconds later.7 min readSecurity · Aug 4, 2026Shift-Left Security Is Dead When Cursor Writes the CodeShift-left security worked because pipeline position tracked developer context. AI code generation broke that link, and pre-commit now fires hundreds of generated lines too late.6 min readSecurity · Aug 3, 2026Why Cursor Installs npm Packages With Known CVEsCursor and other AI editors pin package versions frozen at their training cutoff, so the version they call "latest" can already carry a known CVE the day you install it. Here is why it happens and how npm audit catches it.5 min readSecurity · Jul 31, 2026Why Deleting a Hardcoded Secret Does Not Fix It (CWE-798)AI editors paste live API keys and secrets straight into your source, and deleting the line later does not undo the exposure. Here is why it happens and the two-line fix.4 min readSecurity · Jul 28, 2026Why Cursor Writes IDOR Into Your API Routes (CWE-639)AI editors add a login check to your API routes but skip the ownership check, so any logged-in user can read another user's data by changing the ID in the URL. Here is the one-line fix for IDOR (CWE-639).4 min readSecurity · Jul 27, 2026Why Cursor Writes Login Endpoints With No Rate LimitingAI editors generate login endpoints with correct bcrypt hashing and proper JWTs, then leave out any limit on attempts (CWE-307). Here is why it happens and the two-layer fix.5 min readSecurity · Jul 25, 2026Why Cursor Generates Prototype Pollution in Deep Merge FunctionsAI editors write recursive object merge functions without key guards, turning __proto__ and constructor.prototype into open write channels. Here is the pattern, the attack, and the two-line fix.4 min readSecurity · Jul 24, 2026Why Cursor Keeps Generating Wildcard CORS Headers in Your APIA CORS "fix" that echoes the Origin header back to the browser instead of checking it against an allowlist lets any site make authenticated requests to your API. Here's the pattern AI editors keep generating, and the allowlist fix.4 min readSecurity · Jul 23, 2026Why Cursor Keeps Generating Insecure Random Session Tokens (CWE-330)AI editors keep generating tokens with Math.random(), which is not cryptographically secure. Here is why it happens and how to fix it with crypto.randomBytes.2 min read