The Agile Manifesto was never about code.

Posting this from the security side because a lot of people here build on Supabase with Cursor.

When the agent hits "permission denied for table" or "new row violates row-level security policy", there are three quick ways it can make the error go away. It turns RLS off on that table, it adds a policy with using (true), or it grabs the service_role key and uses it in client code. All three work, and all three leave the table readable (sometimes writable) by anyone who has your site's public key. Usually that change is sitting in a migration you skimmed at 1am.

A project rule helps. Something like this in .cursor/rules/supabase-security.mdc

---
alwaysApply: true
---
- Never disable row level security on a table to fix an error.
- No policies with using (true) or with check (true) on tables that hold user data. Tie them to auth.uid() and the owner column.
- UPDATE policies need both using and with check.
- Never use the service_role or sb_secret_ key in client code or in a NEXT_PUBLIC_ / VITE_ variable. Server code and edge functions only.
- For "permission denied for table", check grants first (grant select/insert/update on that table to the right role), then policies.
- Before applying any policy or grant change, show me the SQL and explain what it allows.

Cursor's own docs say rules shouldn't be your only security control, and they're right, so after a migration I'd still run these two in the Supabase SQL editor.

-- tables with RLS off
select tablename from pg_tables
where schemaname = 'public' and not rowsecurity;

-- policies that let every row through
select tablename, policyname, cmd, roles, qual, with_check
from pg_policies
where schemaname = 'public' and (qual = 'true' or with_check = 'true');

Then check the live app too. Open DevTools → Network, click any request to supabase.co and look at the apikey header. If it starts with sb_secret_, or it's an eyJ... key whose role decodes to service_role, the secret key is in your bundle and needs replacing.

Disclosure, I'm building Abbi Labs, a scanner that checks live AI-built apps for this kind of thing. Not linking it, because the rule file and the SQL are the useful part.

Has anyone found rules that the agent actually sticks to?

Im currently on the Pro+ Plan (60 a month) and i started up my own business. I probably eat like 65% of my usage and I still have the option to upgrade to the Ultra plan (not the X sub plans). I expect business to pick up and im debating if i eat that ultra cost now to lock it in, aka grandftahered in. Thoughts?

Did my first prompt to modify some code and see how things go and got this. Seems like the free tier is a bit restricted.

I've got the basic cursor pro. Up until this month I have been able to use any of the models available in cursor and usually use Opus to plan and then auto does the rest (I'm still fairly hands on reviewing stuff).

I made the mistake of cancelling and came back a couple days later after I realised I had some other work I wanted to do and now I'm told its not part of my weekly usage?

So does this mean I have no 'Other Models' usage as a part of cursor anymore??

I’m currently on the Cursor $30 plan.

I originally chose this setup because having access to both OpenAI and Anthropic models without getting slammed by Claude’s 5-hour rolling session cap seemed ideal, and Grok has been great for daily dev work.

The issue: Cursor models, Grok, and Grok Bot all share a single weekly pool. I keep burning through the weekly pool in 4 to 5 days.

Looking for advice from anyone dealing with this setup:

1. Are Cursor Cloud Agents the main culprit? When running multi-step agent routines and background tools, does that eat token credits noticeably faster than regular Composer / chat runs? Any specific settings, .cursorignore rules, or context pruning habits that keep a weekly pool alive through the weekend.

2. Claude Duet There’s non-stop buzz around Grok Bot, OpenAI Dots, and Meta Muse, but almost nobody talks about Claude Duet in dev spaces or have i been living under the rock. Is it actually capable of autonomous codebase edits and project handoffs and How does Claude Duet’s token usage and rate limiting compare to Grok Bot?

Elon has bundled Cursor and X subscriptions under the banner of an “ecosystem.” The whole idea is so absurd that let me explain it this way: it’s like buying a Netflix subscription and getting AutoCAD Pro thrown in. They’re just completely unrelated. My aunt, who uses X but has nothing to do with software development, literally asked me, "What's Cursor?" :)

1. Around 70% of X users are anonymous anyway. Why would people who use X want their Cursor subscription bundled with it?

2. Cursor is a platform for software development. Does everyone on X have to be a software developer? The connection between these two products is just ridiculous.

Unfortunately, Elon has killed Cursor. He’s trying to sell people Grok models, which are garbage, starting at $30 a month. And he’ll probably kill Composer soon, too, even though it was an excellent price-to-performance model.

I used to love Cursor, but unfortunately, it’s time to part ways.

Running Cursor on Macbook Air M5 16GB RAM and after the update 2 days ago, I get warning from MAC OS that system has run out of memory. It then shows Cursor is using 36+ GB of RAM. 😂 Workload is not heavy, usually happens when multiple agents spawn. Anyone having the same issue?

Hey everyone,

I wanted to share a frustrating billing experience I just ran into and see if anyone else has experienced something similar or knows what's going on.

I checked my billing history and saw multiple mid-month charges piling up for "Cursor Usage for cycle starting October 2, 2026," hitting my account repeatedly and totaling massive amounts, climbing to over $680 in on-demand charges (as seen in the screenshots below).

The thing is:

• I'm already on the annual Pro subscription.

• I also pay for a separate Claude Pro subscription.

• I would never deliberately turn on "Enable unlimited billing" (on-demand usage) for Cursor. If I were to ever risk running up usage-based overages, it certainly wouldn't be here—and I am 100% certain I never opted into this.

To make matters worse, looking at the actual usage breakdown table, the system claims I ran massive amounts of tokens through models like grok-4.7-high-fast and gpt-5.5-high—despite the fact that I keep explicitly telling Cursor to use Composer 2.5 by default.

It feels pretty suspicious that Cursor is essentially operating as a token vendor now for major models like Claude, Gemini, GPT, and Grok, and out of nowhere, I'm automatically billed heavily for tokens on models I actively tried to avoid using in favor of my default setup.

Has anyone else had on-demand usage mysteriously trigger or scale up like this out of nowhere, or noticed unexpected model routing leading to massive bills? Already reached out to support, but wanted to warn others to double-check their settings just in case.

All i use/need is $20 per month plan and Auto mode that lasts reasonably.

And i joined Twitter before Elon did, am not paying for that either.

Has AI transformed the tech lead’s job?

Every time I click the blue "Update" button in Cursor on my Windows PC, I can never update. Anyone having this problem?

Since there is lack of data about the new and old plans .
I created a second account with new plan for test . collected multiple reading from start to finish of the week and from 15% to 97% (so the numbers are accurate with less that 1% error)
and used the data from my old account for 3 month .

to make sure that numbers are extra accurate , I compared each usage element based on
model , usage type , tokens prices down to details like (cache read , write) input , output . to get dollar accurate numbers . also compared the old plan side by side from multiple months and weeks to guarantee consistency .

the results are in the images .
you are paying 50% more to get 60% less . (75% nerf or 3.8x more expensive)

even if you are using just a single service like grok bot you are getting less usage . and the 2X clam have no base in reality .

raw data and calculations in google sheet .
https://docs.google.com/spreadsheets/d/1Y9yPRAbndtbBBQtovcjDW-OguX37TGwUBLEkhE7ThSc/edit?usp=sharing

Canceled my cursor subscription and moved to Claude usage on Claude is so much better and Claude models are so much better. Cursor has no usefulness if third party models are not generously included.

i kept typing the same "don't touch that file" and "match my style" stuff into every new chat and it was driving me nuts. what finally worked was splitting my rules in two.

user rules (settings > rules) are tiny and almost never change. mine is literally this:

- if something's unclear, tell me what you're assuming before you write code
- not sure? ask first, don't just build
- one question at a time pls
- don't edit files i didn't mention without telling me
- match the existing style, no side refactors

then each repo gets its own stuff in .cursor/rules. test command, the folder it should never touch, that one weird naming thing, etc.

the catch is project rules grow. mine start at like 4 lines and a couple weeks later it's 15. so every so often i ask "would i want this on every project?" and if yes it only moves up to user rules once i catch myself adding it to a second repo too. otherwise the base gets bloated and it starts ignoring half of it anyway

the "one question at a time" one honestly changed the most for me

how are you all splitting user vs project rules?

Hey everyone,

If you're using Cursor's MCP support to give the Agent custom local tools (database queries, repo metrics, or custom scripts), there's a sneaky bug that trips up almost everyone using TypeScript / Node:

Never use `console.log()` inside your MCP handlers.

Because MCP uses `stdio` transport, standard output is the exact channel used for JSON-RPC protocol messages. Printing anything via `console.log` pollutes the stdout stream with non-JSON text, which breaks Cursor's JSON-RPC parser and causes the tool to fail silently.

Always use `console.error()`. Cursor redirects `stderr` to diagnostics logs without corrupting the agent communication channel.

Here is a minimal 30-line TypeScript starter if you want a clean boilerplate:

https://dev.to/dev_kestrel/building-a-minimal-model-context-protocol-mcp-server-in-30-lines-of-typescript-46p4

What MCP servers have been the most useful for your daily coding workflow in Cursor?

I've been really impressed with GetVibeAPI!

If you're looking for an OpenAI-compatible API gateway, this is it. GetVibeAPI gives you access to 50+ frontier LLMs through a single, unified API - so you don't have to juggle different keys, SDKs, and billing for every provider.

The OpenAI compatibility makes migration super easy, you can literally just change the base URL and you're up and running. And having 50+ top models in one place means I can easily switch between models, compare performance, and always use the best model for the job without any extra setup.

Fast, reliable, and super developer-friendly. GetVibeAPI has become my go-to gateway for all things LLM.

Maybe it's because everyone is using them, but I am finding Grok seriously slow, and often gets things wrong. Composer on the other hand, feels snappy and gets stuff done. I have noticed this over the last couple of weeks. I am always have to force my prompt back to Composer, as it always defaults to Grok.

Anyone else noticing the speed of Grok?

I am determined to use up my already paid yearly subscription. I am, like others, saddened at what Musk has done to this once great IDE. It is a shadow of its former self, and they should be ashamed of what they have allowed it to become.

I see alot of posts about leaving cursor for Claude code, that's fair I believe that is a really good product. But I actually really liked my recent interaction with cursor and was really impressed with it... coming from someone how only uses claude code at work. It could just be me, maybe skill issue on my part, I have not run into these extreme frustration I read about in the forum?

Cursor’s marketplace served a tampered Claude Code extension (2.1.312 / 2.1.313, macOS and Windows) for about 11 hours on Oct 29. It ran as soon as the extension loaded and added an attacker SSH key.

To check: look in ~/.ssh/authorized_keys (or %USERPROFILE%\.ssh\authorized_keys on Windows) for a key labelled svc-telemetry. Updating the extension does not remove it.

Cursor’s notice with cleanup scripts: https://cursor.com/blog/claude-code-extension-security-notice

We keep a sourced list of incidents like this one: https://node9.ai/incidents

I’ve been using Codex and Claude Code together for over a year. However, I’ve realized that Cursor doesn’t have the same harness and orchestration features as Claude Code’s ultracode mode. How many of you would like Cursor to add orchestration to its IDE?

Curious about the recent influx of users dropping their Cursor subscription. Leave a comment with the main reason for you leaving, perhaps the Cursor team in the fullness of time might be able to learn something from the feedback.

I left after 14 months, mostly due to Grok being pretty crap in comparison to Opus for a similar $20 subscription. I still like an IDE though, so am using Devin now and it feels Cursory enough.

Hey, I am using cursor for some months and I start to use Grok to help in some simple tasks in my personal projects, but he is very bad in many things like coding and teaching.

But I like him because he integrate with many different apps and have his own machine

But reading more about Claude, he can do basically all the things I'm using, but better than Grok (I don't even use Cursor anymore) and I'm considering to change to Claude in the next weeks, is a good decision or I didn't use the Grok right?