Demo Privacy

Secure your development workflow with Cursor AI’s Privacy Mode, data handling guarantees, and custom security rules. In this guide, you’ll learn how to:

• Configure and compare Privacy Mode settings
• Understand Cursor’s privacy policy and data flow
• Enable semantic codebase indexing securely
• Define and apply custom security rules

Privacy Mode Overview

Cursor AI offers a Privacy Mode setting that controls whether your code and prompts are stored or discarded. By default, Cursor sends an X-Ghost-Mode header on every request to keep your usage anonymous.

Privacy Policy Details

Cursor’s official Privacy Policy outlines strict rules when Privacy Mode is on:

• TLDR: Zero data retention of your code, prompts, or interactions
• Other notes: No third-party sharing or AI training on your private code

When Privacy Mode is off, Cursor collects:

• Prompts and code snippets
• Editor actions and code edits
• Inference-provider telemetry to speed up responses

Additional Policy Notes

• All requests, even with your own API key, route through Cursor’s backend for prompt assembly.
• Cursor crafts final prompts and context before reaching OpenAI’s API.
• If you index your codebase, Cursor uploads snippets temporarily to compute embeddings, then discards plaintext.

Codebase Indexing

Cursor supports semantic indexing of your repositories. By default, files in .gitignore or cursor.ignore are omitted. Indexing works as follows:

1. Secure Chunk Upload: Code is uploaded in encrypted chunks for embedding computation.
2. Embedding Generation: Uses Merkle tree structures and Turbopuffer for integrity.
3. Ephemeral Storage: Plaintext is discarded immediately; only embeddings & metadata remain temporarily.

For full details, see the Cursor Security Documentation.

Custom Security Rules

Guide Cursor’s AI to generate secure code by defining custom rules.

1. Create security-best-practices.md in your Cursor rules folder:

   # Security Best Practices
   Applies to: JavaScript, TypeScript, JSX, TSX, Python, Ruby
   
   - Never use `eval` or similar dynamic execution methods.
   - Sanitize all user inputs before processing.
   - Use parameterized queries for database access.
   - Employ secure, up-to-date encryption algorithms.
   - Do not hardcode credentials or secrets.
   - Validate and encode outputs to prevent injection attacks.
   

   

2. For framework-specific rules, add files like react-security.md:

   # React Security Rules
   Applies to: React (JSX, TSX)
   
   - Avoid `dangerouslySetInnerHTML` without sanitation.
   - Leverage React’s built-in XSS protections.
   - Validate component props to enforce data integrity.
   

   

These rule sets ensure Cursor’s code suggestions adhere to your organization’s security standards.

Conclusion

Enabling Privacy Mode and configuring custom security rules in Cursor AI protects your code and enhances compliance—at no extra cost. Whether you’re prototyping or working in a high-security environment, these features keep your data private and your workflows seamless.

Links and References

• Cursor Privacy Policy
• Cursor Security Documentation
• OpenAI API Reference