CursorAnnouncement
Cursor launched two bots for the last mile of shipping code: Rollouts and Security Review. Rollouts watches every change as it deploys and reports health per environment, with verdicts of verified healthy, regression detected, or inconclusive. It reads the diff and systems a pull request touches, writes a monitoring plan as a PR comment, and tracks deploy events per environment. Security Review reads every pull request in the context of the codebase and posts one review comment reporting exploitable bugs, including injection, authentication bypasses, and secrets. Both bots are available today on Teams and Enterprise plans, with usage credits for the next 10 days.
Cursor is launching two bots—Rollouts and Security Review—for Teams and Enterprise plans. Rollouts monitors changes through deployment, reporting health per environment. Security Review reports exploitable bugs on every pull request. Both are available today, with usage credits for the next 10 days.
Rollouts attaches a monitor to every pull request, reads the diff and systems it touches, writes a monitoring plan as a PR comment, tracks deploy events per environment, and reports verdicts (verified healthy, regression detected, or inconclusive). Security Review reads every pull request in the context of the codebase and posts one review comment reporting exploitable bugs, with findings carrying severity, attack path, and proposed fix.
Rollouts writes a monitoring plan as a PR comment listing risks, intended effect, signals to check, and instrumentation gaps; the plan can be edited in the PR.
Security Review traces where user input enters and what it passes through, and enforces team rules such as which client external calls must go through.
When Rollouts detects a regression, it can open a revert PR for review or hand the finding to a cloud agent for a fix, but does not merge or roll back on its own.
Rollouts connects to Origin or GitHub for source control, to your continuous delivery system for deploy events, and to Datadog and other telemetry providers for signals. Feature flag integration is coming soon.
Security Review looks for injection across SQL, command, and template surfaces, authentication and authorization bypasses, secrets and credentials committed to source, SSRF and unvalidated redirects, unsafe deserialization, and dependency changes that introduce known vulnerabilities.
When Rollouts detects a regression, it names the change it suspects and notifies the author. Depending on configuration, it can also open a revert PR for review or hand the finding to a cloud agent for a fix. Rollouts does not merge or roll back on its own today.
Summaries are generated from the original by a language model. Check the original before relying on it.
See the idea
Argo CD is a GitOps controller that treats Git as the desired state and continuously reconciles it against what actually runs in each cluster. It maps the parts of that loop and why pull-based agents change its scale.
Keep reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
One useful email. Unsubscribe anytime.
