1 min lesson
The surface you'd protect
Use "Cursor's product reads, writes and executes code on customer machines and in the cloud" to describe the practical rule.
Step 1 of 3
Cursor's product reads, writes and executes code on customer machines and in the cloud. That single fact creates a security surface that off-the-shelf playbooks don't cover.
Hold four layers in your head, each with its own attacker and its own paved-road defense. The agent layer is the one candidates are likeliest to underweight, so give it the most prep time.
Learn more
Full explanation
The Surface as a Stack
Interactive diagram. Tab through its regions; each focused region shows its detail in the panel below.
Four layers, one engineer. The agent layer is the novel one off-the-shelf playbooks don't cover. Step through for the attacker and the paved road on each.
Don't collapse all four layers into "web AppSec." A candidate who only talks OWASP Top 10 misses the agent and customer-data layers entirely, which are the surfaces unique to Cursor. The editor opening a repo is an untrusted-input problem, not a feature.
QWhy is the agent layer the security surface that off-the-shelf playbooks don't cover and what's its lead threat?