2 min lesson
Test the API review rule
Add one nested API rule, inspect a verbose run, choose review scope and effort, then check the rule's acceptance data.
Check your understanding
Complete the practice "Catch unvalidated API request bodies".
Outcome: Keep the rule when it loads on the intended paths and produces accepted findings. Narrow, rewrite or disable it when it creates noise.
Catch unvalidated API request bodies
Nested rule, verbose run, Custom effort, analytics
SayBugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition. missed three handlers under src/api that read req.body without the shared validator. Add one rule for that production bug.
DoAdd src/api/.cursor/BUGBOT.md. Tell BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition. to flag a production request handler that reads req.body before calling the shared validator.
SeeThe nested file applies when a changed file is under src/api. A .cursor/rules/*.mdcMarkdown-Cursor rule file. The file format for a Cursor rule; set always_apply to false and scope it so the rule only fires on the files that need it instead of burning context every request. Press Enter for the full definition. file would not apply to BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition..
DoComment bugbot run verbose=true on a pull request that changes src/api/auth/session.ts.
SeeThe rule table includes the team rules, root .cursor/BUGBOT.md and nested API rule. It also reports any truncated or omitted rule.
DoLeave Incremental Review off for this test so BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition. reviews the full pull request. On a usage-based plan, set Custom effort to use High for auth and payment paths and Default elsewhere.
SeeThe review covers the current full diff and reports the missing validator at the changed handler. BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition. does not use Quick or Deep effort labels.
DoAfter several pull requests, open the rule analytics and compare issues found, accepted issues and acceptance rate.
SeeKeep the rule when it loads on the intended paths and produces accepted findings. Narrow, rewrite or disable it when it creates noise.
Learn more
Optional practice
Test yourself on Test the API review rule
QWhich result proves the API rule and review settings are ready to keep?