How to find security issues using Cursor

1// Cursor Chat prompt (Cmd+L, Ask mode):
2// @codebase Perform a security audit of this codebase.
3// Find all instances of:
4// 1. SQL queries built with string concatenation or
5//    template literals using user input
6// 2. User input rendered in HTML without escaping
7// 3. User input passed to exec(), spawn(), or eval()
8// 4. User input used in file paths (path traversal risk)
9// 5. User input used in HTTP redirects without validation
10//
11// For each finding, list: file, line, risk level (High/
12// Medium/Low), the vulnerable pattern, and a fix suggestion.

1---
2description: Security rules for input handling
3globs: "src/**/*.ts,src/**/*.tsx"
4alwaysApply: true
5---
6
7## Input Security Rules
8- NEVER concatenate user input into SQL queries — use parameterized queries
9- NEVER use eval(), new Function(), or setTimeout with string arguments
10- NEVER pass user input to child_process.exec() — use execFile with args array
11- NEVER render user input as raw HTML — always escape or use textContent
12- ALWAYS validate and sanitize user input at the API boundary
13- ALWAYS use allowlists for redirect URLs, not blocklists
14- ALWAYS validate file paths against a base directory (prevent path traversal)
15- Use prepared statements for all database queries
16- Use Content Security Policy headers in HTTP responses

1// VULNERABLE (found by audit):
2const result = await db.query(
3  `SELECT * FROM users WHERE email = '${req.body.email}'`
4);
5
6// Select the vulnerable code, press Cmd+K:
7// "Convert this to a parameterized query to prevent SQL
8// injection. Use $1 placeholder syntax for PostgreSQL."
9
10// FIXED:
11const result = await db.query(
12  'SELECT * FROM users WHERE email = $1',
13  [req.body.email]
14);

1// VULNERABLE (found by audit):
2element.innerHTML = `<p>Welcome, ${userName}</p>`;
3
4// Cmd+K prompt:
5// "Fix this XSS vulnerability. Use textContent or a
6// sanitization library instead of innerHTML."
7
8// FIXED:
9const p = document.createElement('p');
10p.textContent = `Welcome, ${userName}`;
11element.appendChild(p);

1// Cursor Chat prompt (Cmd+L, Ask mode):
2// @codebase Re-run the security audit. Check specifically:
3// 1. Are there any remaining SQL string concatenations
4//    with user input?
5// 2. Any innerHTML assignments with user-controlled data?
6// 3. Any exec() calls with user input?
7// 4. Any unvalidated redirect URLs?
8// Report 'PASS' or list remaining issues.