Only the main branch is supported.

Use GitHub private vulnerability reporting for this repository.

Do not open a public issue for anything that involves session cookies, tokens, or other credentials.

• The Cursor session cookie name (WorkosCursorSessionToken) appears in source. That is intentional.
• The cookie value must never be stored, logged, or sent anywhere except https://cursor.com.
• The extension has no backend and collects no telemetry.