Skip to lesson
Exit
AI-assisted review, testing & anti-patterns1 / 3

1 min lesson

Custom rules: .cursor/BUGBOT.md

Walk through the important items in "Custom rules: .cursor/BUGBOT.md" and give the practical point of each.

Step 1 of 3

Custom rules: .cursor/BUGBOT.mdper-area, checked into the repo

Generic review advice is noise. What earns its keep is .cursor/BUGBOT.md, a checked-in file where a team encodes its own hard-won rules:

  • "Never call the billing API without an idempotency key."
  • "All DB migrations must be backward-compatible for one release."
  • "PIIPersonally Identifiable Information. Data that can identify a person (names, emails, SSNs); regulated and sensitive. Press Enter for the full definition. fields must go through the redaction helper."

Because it lives in the repo and can be scoped per area, the same BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition. enforces different standards in the payments directory than in the marketing-site directory. That's how an AI reviewer stops being a generic nag and becomes a guardian of your specific risk tiers.

Learn more

Full explanation

Autofix and isolated VMs

Autofix and isolated VMspropose, don't presume

When BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition. can propose a fix, Autofix spins up an isolated cloud-VM agent to generate the change. It's sandboxed, so fix-generation has no ambient access to your laptop or secrets. Read Autofix correctly in an interview: the win is not automatic merge. The win is AI proposes, human disposes, with a review gate that accepts useful fixes and rejects weak ones.

What destroys trust: false positives

The single fastest way to kill an AI reviewer's credibility is false positives. Three noisy comments and engineers start reflexively dismissing every BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition. comment, including the true one that would have caught the incident.

Tuning is first-class work, not a someday-chore. It needs an explicit owner and a cadence: someone reviews dismissed and ignored comments, sharpens .cursor/BUGBOT.md rules and tracks the signal-to-noise ratio over time. An untuned reviewer is worse than no reviewer. It actively trains your team to ignore review.

Interview framing

Asked 'how do you know BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition. is working?', don't cite bugs found. Cite the signal-to-noise trend and the comment-resolution rate, with a named owner and a review cadence. The metric that matters: are engineers acting on its comments or dismissing them?

Bonus credibility: 'tuning has an owner and a cadence' is the same operating discipline you'd apply to any noisy alerting system. False positives are an SRESite Reliability Engineering. The team and practice that keeps production reliable: monitoring, on-call and incident response. Press Enter for the full definition. problem, not a tooling quirk.

Learn more

Optional practice

Practice: Custom rules: .cursor/BUGBOT.md

QA skeptic says Autofix is useless unless most proposed fixes merge. Correct them.

QWhy is tuning BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition. (owner + cadence) treated as first-class work rather than a one-time setup?