The vulnerability classes that matter

The secure-code-review onsite hands you unfamiliar code and watches what you flag first. Strong reviewers don't memorize CVEs - they recognize a handful of vulnerability classes and trace each one to its root cause in seconds.

A Security Software Engineer at Cursor is a builder who reasons about attack surface fluently. The screens reward pattern recognition: you should look at a line and feel the class it belongs to, then name the fix that kills the whole class rather than the single line. That instinct is what separates a security engineer from a linter.

Almost every web vuln you'll be shown collapses into a small number of families. Learn the root cause and the paved-road fix for each and you can review code you've never seen.