Cursor Security and Code Quality — One Prompt, 19 Findings, One Rescan

This guide uses a synthetic DeskQueue internal IT support service written for the walkthrough only. It is not a real product and was never deployed. The entire application under src/ was produced from one prompt in Cursor; nothing was edited by hand before the baseline scan.

The prompt asked for a small desk queue — staff login, searchable ticket lists, CSV reports that can be zipped, attachment upload, saved view presets from a desktop export, and admin endpoints for asset sync and server stats. It deliberately did not ask for security hardening, tests, or Docker.

Save the prompt text alongside the archive you upload so later readers can see what the model was asked to produce.

Request a token with the account credentials and a name you will recognise later. Send the access token as a bearer credential on every subsequent request.

If token creation returns SESSION_LIMIT_REACHED, revoke unused tokens or clear active JWT sessions on the installation before retrying.

Create a SAST project for the DeskQueue sample, then reuse the same project UUID for the rescan after remediation.

Package the source as a zip archive. The scan uploads that archive directly; nothing needs to be checked into a repository the scanner can reach.

Start the scan with languages=TYPESCRIPT and cqLanguages=TYPESCRIPT so DerScanner analyses security rules and code-quality rules in the same pass.

Keep AI triage flags off for every severity. The scan analyses the code and leaves every finding unverified until you choose otherwise.

The response returns the scan UUID to poll. On the baseline capture, DerScanner reported 19 security findings — seven critical and twelve medium — with a security score of 25 across 624 lines. Code Quality on the same scan reported a CQ score of 30 with 114 critical CQ findings across 436 analyzed lines.

Poll the project scan list until status is COMPLETE. Each scan DTO includes security counts (critical, medium, low, info, score, loc) and quality counts (criticalCq, mediumCq, scoreCq, locCq).

The baseline scan surfaced command injection on shell-backed export and admin routes, eval on preset import, SQL injection on login and ticket search, weak MD5 password hashing, CSRF advisories, and a large CQ footprint — var usage, throw-literal throws, hardcoded paths, and camelCase violations.

DerScanner does not ship a single hybrid report that merges security and quality. Export the fields you need from the API or the statistics page, then assemble the combined view in Cursor Canvas or your own reporting tool.

Open the detailed results view for the baseline scan. The finding list groups issues by rule family — TS_INJECTION_COMMAND, TS_INJECTION_CODE, TS_INJECTION_SQL, TS_CRYPTO_BAD_HASH, TS_CSRF, and others.

Command injection findings point at execSync calls that interpolate user input into a shell command for zip export and asset sync.

Code injection comes from eval on preset import. SQL injection comes from string concatenation in login and ticket filter queries.

Send a second prompt that references the DerScanner results and asks for specific fixes — parameterized SQL, no eval, no shell execution for exports, bcrypt instead of MD5, environment-backed secrets, httpOnly cookies, and safe path handling for attachments.

The remediation prompt is saved as PROMPT-REMEDIATION.txt in the sample archive so the before/after provenance is clear.

Re-zip the project after Cursor applies the edits. Do not hand-tune findings to satisfy individual rules; the goal is the kind of fix batch a team would accept from an AI assistant after a scan.

Upload the remediated archive to the same project with the same languages, cqLanguages, and triage flags as the baseline scan.

Poll until the second scan completes. Compare rule families, not only the aggregate score — LOC increased after adding bcrypt and archiver, which can move the headline score even when exploitable sinks are removed.

On this capture, command injection, code injection, and weak-crypto rule hits dropped to zero — ten SAST rule hits removed in total. Total security findings went from nineteen to thirteen. CQ score rose from 30 to 63 and critical CQ findings dropped from 114 to 41. CSRF advisories remain on some state-changing routes where static analysis does not recognize the custom CSRF middleware.

Open the detailed results for the rescan. TS_INJECTION_COMMAND, TS_INJECTION_CODE, and TS_CRYPTO_BAD_HASH no longer appear.

Remaining findings on this capture are CSRF advisories, SQL and path rules on defensive code paths, and a reflected XSS rule on CSV export — useful input for a third remediation pass if you extend the guide.

Use the issues endpoint or the interface to export UUIDs if you later run selective DerTriage on individual rows.

DerScanner exposes security and quality metrics separately in the scan DTO and Overview page. Pull critical, medium, score, loc, criticalCq, mediumCq, scoreCq, and locCq from the REST API, group findings by ruleId, and lay them out in a Cursor Canvas beside a hygiene checklist for the generated code.

The baseline hybrid report for this capture shows security score 25 with seven critical and twelve medium findings, plus CQ score 30 with 114 critical CQ findings — var usage, throw-literal, eval, and MD5 patterns dominate both slices.

Reuse the same Canvas layout with the rescan UUID. Swap the rule bar chart for the after capture and replace the hygiene checklist with the remediation changes Cursor applied — parameterized SQL, bcrypt, archiver-based zip export, environment-backed secrets, and httpOnly cookies.

Command injection, code injection, and weak-crypto rule hits drop to zero on this rescan. CQ score rises to 63 and critical CQ findings fall to 41 after removing var, eval, MD5, and throw-literal patterns.

Add a third Canvas that plots baseline and after counts side by side by rule family — command injection, eval, weak crypto, SQL rules, and CSRF advisories.

Include a short score context note. Aggregate security score moved from 25 to 39 because LOC grew after adding bcrypt, archiver, and CSRF middleware; CQ score moved from 30 to 63 as hygiene patterns were removed.

Open Scans Comparison in DerScanner and select the baseline and after scans. The native chart shows remaining, fixed, and new findings by severity.

Use this view alongside the Canvas panels — product UI for drill-down, Canvas for the combined security-and-hygiene story you export to stakeholders.