2 min lesson
Write the finding like a PR comment
Work through this case: "You have 30 minutes and 400 lines of unfamiliar code. What's the first thing you do and why not just read top to bottom?" Say what you would do and why.
Step 1 of 2
Write the finding like a PR commentclear, actionable, non-preachy
A finding that lands is one the author can act on without re-deriving your reasoning. Skip the lecture. Name the bug, show the line, state the impact and give the fix - ideally as a suggested diff.
SSRF - line 42, `fetch(req.body.url)` calls an attacker-controlled URL with no allowlist, so it can reach internal services and cloud metadata. Fix: resolve the host, reject private/link-local ranges and allowlist the handful of domains this integration actually needs.
The class named (SSRF, IDOR, XSS) so it's searchable.
The exact location and a one-sentence impact.
A concrete fix, ideally a diff the author can accept.
Moralizing or vague "this isn't secure" with no line.
A theoretical risk no attacker can reach, flagged as critical.
A fix that breaks the feature, with no path that keeps it working.
I'll start at the entry points and follow untrusted data to the dangerous sinks, checking the control at each boundary. I'll call out findings as I go, rank them by what an unauthenticated attacker can reach and give each one a concrete fix.
That framing is exactly how Cursor's own agent-assisted Security Review operates in production: it leaves findings as PR comments and blocks CI on security issues. Reviewing the way the company already reviews is a strong, honest signal that you'd fit the workflow.