Anysphere · Vulnerability Disclosure

Anysphere Vulnerability Disclosure

Vulnerability disclosure

Anysphere publishes a vulnerability disclosure policy for reporting security issues. A machine-readable /.well-known/security.txt is served. A dedicated security contact is published.

CompanyDeveloper ToolsArtificial IntelligenceCode EditorCoding AgentsCloud AgentsDeveloper ProductivityIDE
Program: security.txt present

Disclosure Policy

Policy
https://cursor.com/security

Security Contact

Contact
https://github.com/getcursor/cursor/security
Contact
mailto:security-reports@cursor.com
Contact
mailto:security@cursor.com

Source

Vulnerability Disclosure

Raw ↑ 
generated: '2026-07-17'
method: searched
probe: true
source: well-known/anysphere-security.txt + https://cursor.com/security
policy:
- https://cursor.com/security
contact:
- https://github.com/getcursor/cursor/security
- mailto:security-reports@cursor.com
- mailto:security@cursor.com
preferred_languages: en
acknowledgement: 5 business days (per cursor.com/security)
bug_bounty: false
evidence:
- source: well-known/anysphere-security.txt
  kind: security.txt
- source: https://cursor.com/security
  kind: security-policy-page
notes: >-
  Cursor prefers vulnerability reports via its GitHub Security page
  (github.com/getcursor/cursor/security), with security-reports@cursor.com as a secondary
  contact and a stated 5-business-day acknowledgement. No formal public bug-bounty program.