Skip to content
Terms.

Security changed Cursor, Oct 1, 2025

Cursor · Oct 1, 2025 · 31 added, 18 removed · found in an Internet Archive capture

Archived copyAll Cursor terms
  1. Added: Explore how each mode affects how data is sent and stored.
  2. Added: AWS Sees and stores code data :
  3. Added: Microsoft Azure Sees code data :
  4. Added: Google Cloud Platform (GCP) Sees code data :
  5. Added: We rely on many of OpenAI's models to give AI responses. Requests may be sent to OpenAI even if you have an Anthropic (or someone else's) model selected in chat (e.g., for summarization)*. We have a zero data retention agreement with OpenAI.
  6. Added: We rely on many of Anthropic's models to give AI responses. Requests may be sent to Anthropic even if you have an OpenAI (or someone else's) model selected in chat (e.g., for summarization)*. We have a zero data retention agreement with Anthropic.
  7. Added: Google Cloud Vertex API Sees code data :
  8. Added: We rely on some Gemini models offered over Google Cloud's Vertex API to give AI responses. Requests may be sent to Google Cloud Vertex API even if you have an OpenAI (or someone else's) model selected in chat (e.g. for summarization)*. We have a zero data retention agreement with Vertex.
  9. Removed: We rely on many of OpenAI's models to give AI responses. Requests may be sent to OpenAI even if you have an Anthropic (or someone else's) model selected in chat (e.g. for summarization). We have a zero data retention agreement with OpenAI.
  10. Removed: We rely on many of Anthropic's models to give AI responses. Requests may be sent to Anthropic even if you have an OpenAI (or someone else's) model selected in chat (e.g. for summarization). We have a zero data retention agreement with Anthropic.
  11. Removed: We rely on some Gemini models offered over Google Cloud's Vertex API to give AI responses. Requests may be sent to Google Cloud Vertex API even if you have an OpenAI (or someone else's) model selected in chat (e.g. for summarization). We have a zero data retention agreement with Vertex.
  12. Added: Turbopuffer Stores obfuscated code data :
  13. Added: Exa See search requests (potentially derived from code data) :
  14. Added: Used for web search functionality. Search requests are potentially derived from code data (e.g., when using "@web" in the chat, a separate language model will look at your message, conversation history and current file to determine what to search for, and Exa/SerpApi will see the resulting search query).
  15. Added: SerpApi See search requests (potentially derived from code data) :
  16. Added: We use Datadog for logging and monitoring. As discussed in the Privacy Mode Guarantee section, logs related to privacy mode users do not contain any code data.
  17. Added: Databricks Sees no code data :
  18. Removed: We use Datadog for logging and monitoring. As discussed in the Privacy Mode Guarantee section , logs related to privacy mode users do not contain any code data.
  19. Added: Voltage Park Sees no code data :
  20. Added: Google Workspace Sees no code data :
  21. Added: *Cursor respects model blocklists and will not send any requests to models on a blocklist.
  22. Added: Cursor is a fork of the open-source Visual Studio Code (VS Code), maintained by Microsoft. They publish security advisories on their GitHub security page . Every other mainline VS Code release, we merge the upstream 'microsoft/vscode' codebase into Cursor. You can check which version of VS Code that your Cursor version is based on by clicking "Cursor > About Cursor" in the app. If there is a high-severity security-related patch in the upstream VS Code, we will cherry-pick the fix before the next merge and release immediately.
  23. Removed: Cursor is a fork of the open-source Visual Studio Code (VS Code), maintained by Microsoft. They publish security advisories on their GitHub security page . Every other mainline VS Code release, we merge the upstream ' microsoft/vscode ' codebase into Cursor. You can check which version of VS Code that your Cursor version is based on by clicking "Cursor > About Cursor" in the app. If there is a high-severity security-related patch in the upstream VS Code, we will cherry-pick the fix before the next merge and release immediately.
  24. Added: 'api2.cursor.sh' : Used for most API requests.
  25. Added: 'api3.cursor.sh' : Used for Cursor Tab requests (HTTP/2 only).
  26. Added: 'repo42.cursor.sh' : Used for codebase indexing (HTTP/2 only).
  27. Added: 'api4.cursor.sh' , 'us-asia.gcpp.cursor.sh' , 'us-eu.gcpp.cursor.sh' , 'us-only.gcpp.cursor.sh' : Used for Cursor Tab requests depending on your location (HTTP/2 only).
  28. Added: 'marketplace.cursorapi.com' , 'cursor-cdn.com' , 'downloads.cursor.com' , 'anysphere-binaries.s3.us-east-1.amazonaws.com' : Used for client updates and for downloading extensions from the extension marketplace.
  29. Removed: ' api2.cursor.sh ' : Used for most API requests.
  30. Removed: ' api3.cursor.sh ' : Used for Cursor Tab requests (HTTP/2 only).
  31. Removed: ' repo42.cursor.sh ' : Used for codebase indexing (HTTP/2 only).
  32. Removed: ' api4.cursor.sh ' , ' us-asia.gcpp.cursor.sh ' , ' us-eu.gcpp.cursor.sh ' , ' us-only.gcpp.cursor.sh ' : Used for Cursor Tab requests depending on your location (HTTP/2 only).
  33. Removed: ' marketplace.cursorapi.com ' , ' cursor-cdn.com ' , ' downloads.cursor.com ' , ' anysphere-binaries.s3.us-east-1.amazonaws.com ' : Used for client updates and for downloading extensions from the extension marketplace.
  34. Added: Workspace Trust is disabled by default in Cursor. You can enable it by setting 'security.workspace.trust.enabled' to 'true' in your Cursor settings. It is disabled by default to prevent confusion between Workspace Trust's "Restricted Mode" and Cursor's "Privacy Mode", and because its trust properties are nuanced and hard to understand (for example, even with Workspace Trust enabled, you are not protected from malicious extensions, only from malicious folders). We are open to community feedback on whether we should enable it by default.
  35. Added: Extension code signatures: Cursor does not verify signatures of extensions that are downloaded from the marketplace. VS Code recently started doing this. In particular, the 'extensions.verifySignature' setting defaults to 'false' in Cursor but to 'true' in VS Code. If you set it to 'true' in Cursor, you'll see a pop-up saying that signature verification failed, every time you try to download an extension. We hope to start supporting extension signature verification in the medium-term future.
  36. Removed: Workspace Trust is disabled by default in Cursor. You can enable it by setting ' security.workspace.trust.enabled ' to ' true ' in your Cursor settings. It is disabled by default to prevent confusion between Workspace Trust's "Restricted Mode" and Cursor's "Privacy Mode", and because its trust properties are nuanced and hard to understand (for example, even with Workspace Trust enabled, you are not protected from malicious extensions, only from malicious folders). We are open to community feedback on whether we should enable it by default.
  37. Removed: Extension code signatures: Cursor does not verify signatures of extensions that are downloaded from the marketplace. VS Code recently started doing this. In particular, the ' extensions.verifySignature ' setting defaults to ' false ' in Cursor but to ' true ' in VS Code. If you set it to ' true ' in Cursor, you'll see a pop-up saying that signature verification failed, every time you try to download an extension. We hope to start supporting extension signature verification in the medium-term future.
  38. Added: Our codebase indexing feature works as follows: when enabled, it scans the folder that you open in Cursor and computes a Merkle tree of hashes of all files. Files and subdirectories specified by '.gitignore' or '.cursorignore' are ignored. The Merkle tree is then synced to the server. Every 10 minutes, we check for hash mismatches, and use the Merkle tree to figure out which files have changed and only upload those.
  39. Removed: Our codebase indexing feature works as follows: when enabled, it scans the folder that you open in Cursor and computes a Merkle tree of hashes of all files. Files and subdirectories specified by ' .gitignore ' or ' .cursorignore ' are ignored. The Merkle tree is then synced to the server. Every 10 minutes, we check for hash mismatches, and use the Merkle tree to figure out which files have changed and only upload those.
  40. Added: To block specific files in your codebase from being sent to Cursor's servers and included in AI requests, add a '.cursorignore' file to your codebase that lists the files and directories that should be excluded. Cursor will make a best effort to prevent exposure of these files from being included in any request.
  41. Added: File path obfuscation details: the path is split by '/' and '.' and each segment is encrypted with a secret key stored on the client and a deterministic short 6-byte nonce. This leaks information about directory hierarchy, and will have some nonce collisions, but hides most information.
  42. Removed: To block specific files in your codebase from being sent to Cursor's servers and included in AI requests, add a ' .cursorignore ' file to your codebase that lists the files and directories that should be excluded. Cursor will make a best effort to prevent exposure of these files from being included in any request.
  43. Removed: File path obfuscation details: the path is split by ' / ' and ' . ' and each segment is encrypted with a secret key stored on the client and a deterministic short 6-byte nonce. This leaks information about directory hierarchy, and will have some nonce collisions, but hides most information.
  44. Added: Our indexing feature often experiences heavy load, which can cause many requests to fail. This means that sometimes, files will need to be uploaded several times before they get fully indexed. One way this manifests is that if you check the network traffic to 'repo42.cursor.sh' , you may see more bandwidth used than expected.
  45. Removed: Our indexing feature often experiences heavy load, which can cause many requests to fail. This means that sometimes, files will need to be uploaded several times before they get fully indexed. One way this manifests is that if you check the network traffic to ' repo42.cursor.sh ' , you may see more bandwidth used than expected.
  46. Added: Each request to our server includes an 'x-ghost-mode' header, containing a boolean value denoting if the user is on privacy mode. To prevent accidentally treating a privacy mode user as a non-privacy mode user, we always default to assuming that a user is on privacy mode if the header is missing.
  47. Added: All requests to our server first hit a proxy, that decides which logical service should handle the request (e.g., the "chat service" or the "Cursor Tab service"). Each logical service comes in two near-identical replicas: one replica that handles privacy mode requests, and one replica that handles non-privacy mode requests. The proxy checks the value of the 'x-ghost-mode' header and sends the request to the appropriate replica. The replicas themselves also check the header for redundancy. By default, all log functions from the privacy mode replicas are no-ops, unless suffixed like 'infoUnrestricted' , which we carefully review to never attach any potential code data or prompts. For requests that spawn off background tasks, we similarly have parallel queues and worker replicas for privacy mode and non-privacy mode. This parallel infrastructure makes us confident in our privacy mode guarantee and its resilience against accidental mistakes or bugs.
  48. Removed: Each request to our server includes an ' x-ghost-mode ' header, containing a boolean value denoting if the user is on privacy mode. To prevent accidentally treating a privacy mode user as a non-privacy mode user, we always default to assuming that a user is on privacy mode if the header is missing.
  49. Removed: All requests to our server first hit a proxy, that decides which logical service should handle the request (e.g. the "chat service" or the "Cursor Tab service"). Each logical service comes in two near-identical replicas: one replica that handles privacy mode requests, and one replica that handles non-privacy mode requests. The proxy checks the value of the ' x-ghost-mode ' header and sends the request to the appropriate replica. The replicas themselves also check the header for redundancy. By default, all log functions from the privacy mode replicas are no-ops, unless suffixed like ' infoUnrestricted ' , which we carefully review to never attach any potential code data or prompts. For requests that spawn off background tasks, we similarly have parallel queues and worker replicas for privacy mode and non-privacy mode. This parallel infrastructure makes us confident in our privacy mode guarantee and its resilience against accidental mistakes or bugs.
About this change
Page
cursor.com/security
Kind
Documentation
Text hash
6aca484250d6 to 1409a1314d82
Dated by
the first Internet Archive capture sampled that shows the new text; the change happened on or before this date

Terms changes by email

Mondays, only in weeks when a watched page changed.

Double opt-in. Unsubscribe any time.