Cursor security: hooks, auto-run, .cursorignore and privacy mode

Is Cursor safe?

With its defaults, on code you trust, yes: the agent asks before running commands. The risks are the same as for any coding agent: a destructive command you didn't read, secrets pulled into the conversation, and instructions hidden in content the agent reads. The more you automate, the more the settings below matter.

Auto-run, formerly YOLO mode

In the agent settings you choose whether terminal commands need your approval. Auto-run lets them through, with an allow list of commands that never ask and a deny list of commands that always do. Separate switches protect file deletion, dotfiles and files outside the workspace. Leave those on.

A command deny list is a convenience, not a boundary. It matches command names, and there's always another way to write the same thing: rm can become find -delete, a Python one-liner or a script.

.cursorignore

A .cursorignore file in the project root, with the same syntax as .gitignore, keeps matching files out of indexing, search and the agent's file reads.

.env
.env.*
!.env.example
secrets/
*.pem
*.tfvars
*.tfstate

Cursor describes this as best-effort. It covers Cursor's own file tools. A terminal command the agent runs, such as cat .env, isn't subject to it.

Privacy mode

Privacy mode is about what happens to your code after it leaves your machine: with it on, your code isn't stored by Cursor or used for training. It's worth turning on, and it has nothing to do with what the agent can do on your Mac. It doesn't stop the agent reading a secret or running a command.

Cursor hooks

Hooks are the control with real teeth. Cursor runs your program at set points in the agent loop and acts on its answer. They're configured in ~/.cursor/hooks.json for all projects, or .cursor/hooks.json in one.

{
  "version": 1,
  "hooks": {
    "beforeShellExecution": [{ "command": "~/.cursor/hooks/guard.sh" }],
    "beforeReadFile": [{ "command": "~/.cursor/hooks/guard.sh" }]
  }
}

The hook receives JSON on standard input, with the command in command or the path in file_path, and answers with JSON on standard output:

{
  "permission": "deny",
  "userMessage": "Blocked: reads a secret file",
  "agentMessage": "Reading .env files is not allowed. Use .env.example for variable names."
}

Checkpoints

Cursor saves a checkpoint as the agent edits, and you can restore one from the chat. As with other agents, checkpoints cover the agent's own edits. Files changed or deleted by a terminal command aren't included.

Adding a safety net with Rollcage

• The Guard installs beforeShellExecution, beforeReadFile and beforeMCPExecution hooks for you. They block reads of secret files by any route, commands that print the environment, uploads to paste and file-drop sites, and destructive commands.
• Snapshots clone the project when Cursor's agent starts, so files removed by a terminal command can be restored.
• The same rules apply in Claude Code, Codex CLI and Gemini CLI, so you set them once.

Questions