Which Cursor plans include Rollouts and Security Review?

Cursor Rollouts and Security Review are available on the Teams and Enterprise plans, turned on from the automations tab of the Cursor dashboard. For the first 10 days Cursor gives usage credits to try them: roughly 50 changes on Teams and 500 on Enterprise, according to the changelog. The changelog does not list them for individual plans.

What kinds of bugs does Cursor Security Review look for?

Cursor Security Review looks for exploitable problems rather than style: SQL, command and template injection, authentication and authorization bypasses, committed secrets, SSRF, unsafe deserialization and risky dependency changes. Each finding comes with a severity, an attack path and a proposed fix, and it can be dismissed with a reason. Teams can also add their own rules that it checks on every PR.

How is Cursor Security Review different from Bugbot?

Cursor splits the two jobs. Bugbot keeps handling general code quality and style review on pull requests, while Security Review only reports exploitable security bugs, such as injection or broken authentication. Cursor's changelog describes Security Review as focused on bugs an attacker could use, reviewed in the context of the wider codebase rather than the diff alone.

What does Cursor Rollouts do when it finds a regression?

When Cursor Rollouts detects a regression after a deploy, it names the change it suspects and notifies the pull request's author. Cursor's blog says it can also be configured to pause a progressive rollout or open a revert PR. It reads signals from telemetry providers such as Datadog, Grafana and Honeycomb; feature-flag integration is listed as coming soon.

Cursor · 2026-09-23 · major

Cursor Rollouts and Security Review — bots that watch a PR into production

Cursor launched two bots for Teams and Enterprise. Rollouts follows each pull request through deploys and flags regressions per environment. Security Review checks every PR for exploitable bugs such as injection, auth bypasses and leaked secrets.

Cursor blog graphic for two new bots, Rollouts and Security Review

Two new Cursor bots: one checks a change's health after it deploys, the other hunts exploitable bugs in every PR.

Quick facts

Maker	Cursor
Plans	Teams and Enterprise
Turn on	Automations tab in the dashboard
Telemetry	Datadog, Grafana, Honeycomb
Launch credits	10 days: about 50 changes (Teams), 500 (Enterprise)

What is it?

Rollouts and Security Review are two bots Cursor added for the last step of shipping code. Rollouts watches each change as it deploys and reports its health per environment. Security Review reads every pull request for exploitable bugs, while style and quality review stays with Cursor's existing Bugbot.

How does it work?

When a PR opens, Rollouts posts a monitoring plan as a comment — risks, intended effects, signals to check and missing instrumentation — which the team can edit. On each deploy event it compares logs, metrics and traces against the pre-deploy baseline and reports a verdict back to the PR; on a regression it names the suspected change and can notify the author, pause a progressive rollout or open a revert PR. Security Review reads the PR in the context of the whole codebase and returns each finding with a severity, an attack path and a proposed fix, plus any team rules you add.

Why does it matter?

Coding agents now write more pull requests than people can carefully check, so the risky part moves to review and deploy. Cursor says Security Review cut its average review time from 4.8 to 3.8 minutes and raised the share of accepted findings from 45–50% to 60–70%. Rollouts aims to catch a region- or endpoint-specific regression before a global alert fires.

Who is it for?

engineering teams on Cursor Teams or Enterprise

Frequently asked questions

Which Cursor plans include Rollouts and Security Review?: Cursor Rollouts and Security Review are available on the Teams and Enterprise plans, turned on from the automations tab of the Cursor dashboard. For the first 10 days Cursor gives usage credits to try them: roughly 50 changes on Teams and 500 on Enterprise, according to the changelog. The changelog does not list them for individual plans.
What kinds of bugs does Cursor Security Review look for?: Cursor Security Review looks for exploitable problems rather than style: SQL, command and template injection, authentication and authorization bypasses, committed secrets, SSRF, unsafe deserialization and risky dependency changes. Each finding comes with a severity, an attack path and a proposed fix, and it can be dismissed with a reason. Teams can also add their own rules that it checks on every PR.
How is Cursor Security Review different from Bugbot?: Cursor splits the two jobs. Bugbot keeps handling general code quality and style review on pull requests, while Security Review only reports exploitable security bugs, such as injection or broken authentication. Cursor's changelog describes Security Review as focused on bugs an attacker could use, reviewed in the context of the wider codebase rather than the diff alone.
What does Cursor Rollouts do when it finds a regression?: When Cursor Rollouts detects a regression after a deploy, it names the change it suspects and notifies the pull request's author. Cursor's blog says it can also be configured to pause a progressive rollout or open a revert PR. It reads signals from telemetry providers such as Datadog, Grafana and Honeycomb; feature-flag integration is listed as coming soon.