Security Review

Security Review checks pull requests for security bugs, risky patterns, and vulnerabilities before they merge. Security Reviewer agents run on Automations, and the /review-security skill runs the same review from your own agent before you push.

To scan code that's already merged and patch what you find, use Vulnerability Remediation.

Setup

Open the Security Review page in Automations to create and configure Security Reviewer agents. Security Reviewer agents require Cloud Agents.

Source control support

Security Reviewer supports repositories on Origin, GitHub, GitLab, and Bitbucket Cloud.

Triggers

Security Reviewer agents support Git-based Automations triggers, including pull request and merge request events. Use these triggers to run security checks when code changes.

Security checks

Security Reviewer includes built-in security checks. Enable or disable individual checks based on what you want each agent to review.

Custom instructions

Use custom instructions to give each agent more context. You can describe the types of issues to prioritize, explain project-specific security expectations, or define how the agent should behave.

Tools and MCPs

A Security Reviewer needs at least one tool or MCP before you can save it. Use tools and MCPs to connect it to the systems where your team tracks security work.

• Send vulnerabilities to a Slack channel, issue tracker, or another connected system.
• Add custom instructions that explain when and how the agent should use each MCP.
• Give the agent extra context from tools or MCPs before it reports a finding.

Environment setup

Both Cursor-managed hosting and Cloud Agents are used in this solution. If a team requires Self-Hosted Machines then scans remain on Cloud Agents.

Run in your agent

Use the /review-security or /review skills to run Security Review from your agent before you push the code.

What diff is reviewed: By default, /review-security reviews your branch changes: every change relative to the base branch, including committed and uncommitted changes. Ask it to review only your uncommitted changes when you want narrower feedback.

Against which branch: /review-security compares against your default base branch. When your base branch isn't the default (such as main), tell the agent which branch to compare against or let it infer from the context.

Billing

Security Reviewer agents are billed at the team usage level:

• Usage is charged to the team's usage pool.
• Agents run under a shared team service account, so they don't affect any individual user's usage.

Analytics

The Security Review page in Automations tracks three key metrics across agent runs:

• Vulnerabilities found: the number of security findings reported by agents.
• Issues fixed: the number of findings that were resolved after they were reported.
• Resolution rate: the percentage of reported findings that were fixed.

To determine whether an issue was fixed, Cursor uses LLMs to review incremental diffs and assess whether the flagged issue was resolved.

Viewing runs

The Security Review page in Automations lists Recent Runs for your Security Reviewer agents. Use the run history to see when an agent ran, which tools it used, its final status, and how long it took.

Open a run to inspect the underlying Cloud Agent for more detail about what the agent did. A review that ran on Cursor-managed hosting has no Cloud Agent; opening it shows a read-only view of the review session.

Related pages

• Vulnerability Remediation scans your codebase at rest and patches confirmed vulnerabilities.
• Bugbot reviews pull requests for bugs before they merge.
• Rollouts monitors each pull request as it deploys and reports its health in every environment.