Skip to lesson
Exit
The Interview Loop1 / 2

2 min lesson

The practical / take-home project

Use "The practical / take-home project" to tell the cases apart, then choose a response for each one.

Step 1 of 2

The practical is where engineering judgment shows. The JD's onsite explicitly includes a small project and a take-home is the standard senior-security pattern, so plan for a realistic build task you carry from a blank repo to something defensible.

Whatever the exact prompt, the rubric is consistent: secure defaults, clean code and crisp written reasoning about what you traded away and why. A small thing that works and is well-justified beats a sprawling thing that half-works.

Harden a service

A deliberately weak app or API.

Find the vulns, fix them and show the secure default is now the easy path.

Build a review tool

A small secure-code-review or scanning tool.

Mirrors Cursor's own agent-assisted review across effectively every internal PR.

Threat-model + fix

A vulnerable app to model and repair.

Map trust boundaries, then fix by impact, not by line count.

  1. 1Scope ruthlessly in the first 20 minutes. Decide what 'done' means and what you're explicitly cutting. Write that down before you write code.
  2. 2Ship secure defaults, not retrofitted security. Parameterized queries, least-privilege creds, deny-by-default, secrets out of the repo - baked in from the first commit.
  3. 3Keep the code clean and tested. They're hiring a strong engineer. Sloppy code with great security ideas still reads as a no-hire.
  4. 4Write the reasoning down. A short README with your threat model, the risks you mitigated and what you deliberately left out and why.
  5. 5Make the safe path the only easy path. Wherever you can, design so the next change can't reintroduce the vuln you just fixed.
Document what you left out, on purpose

The single most impactful paragraph in your README is the one listing what you didn't do: rate limiting deferred because it's infrastructure-level, full audit logging stubbed because the storage backend was out of scope, key rotation noted but not built. Naming your omissions with reasons signals scope discipline and honest self-assessment - both core to truth-seeking. Silence on tradeoffs reads as not noticing them.

Learn more

Full explanation

Sprawl is the common failure

Sprawl is the common failure

The trap on a take-home is gold-plating - adding a fifth defense while the core flow is untested. Cursor values pace and end-to-end ownership, which means finishing. A reviewer trusts a candidate who shipped a complete, well-reasoned slice far more than one who left an ambitious half-built fortress with a broken front door.

QYou're given a take-home to harden a small service and you have limited time. What allocation best matches Cursor's bar?