2 min lesson
Verify before quoting
Consider this situation. "A security lead asks: 'Does Cursor retain our prompts and code?' Your team uses its own model API keys. What's the precise answer?" Start with the decision, then the evidence.
Step 1 of 3
Drill 3 trap: a security lead will ask 'do you retain our data?' If the customer brings their own API keys, zero-data-retention does not apply. The retention terms then ride on the model provider, not on Cursor. Saying 'we never retain anything' when they use their own keys is a credibility-ending error. Get this distinction exactly right.
The BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition. June-2026 figures of about 90 seconds average review, 22% lower run cost and about 10% more bugs found, current Teams seat pricing on cursor.com/pricing, and enterprise thresholds. Treat these as perishable: confirm against current Cursor materials before you say them out loud.