Commit progress so a model switch can't undo it
Hours into a hard bug, about 90% fixed, the session switched models. With no git commits along the way, most of the work was lost.
Cursor: real stories
19 items
Cap spending before leaving an agent unattended
Left alone on a hard bug, an agent repeated the same steps for nearly two hours. The poster says no refund was given.
Keep your .env file away from AI agents
After an update, Cursor's agent edited .env files it hadn't touched before, so the builder treated the keys as exposed and rotated them.
Choose the right model to avoid a one-day usage burn
Using Opus, a Cursor user hit 100% of the plan's API usage in one long session, and exported the usage CSV to check.
Enforce rules with tools, not just prompts
An agent kept adding commit trailers it had been told not to add, even in the same turn.
Plan sessions around Claude Code usage limits
A builder hit the Claude Code usage limit within the first hour and asked which tool keeps going.
Keep one project brief every AI tool can read
Rotating between Codex, Claude Code and Cursor to dodge limits meant repeating the same project explanation in each one.
Stop an agent from rewriting working auth code
A builder spent hours tuning Cursor prompts so the agent would stop rewriting working authentication code.
Stop burning a month of Cursor usage in days
A user shared a screenshot of Cursor usage burned through in the first days of a billing period.
Move a Lovable project into your own repo early
Over about three weeks a PM shipped an education platform, started in Lovable, hit its limits, moved to their own repo with Claude Code, and then rebuilt on Next.js for SEO.
Plan the database and backend before building
A non-developer made progress on a front end with Copilot about 10 months earlier, then got stuck on the database and backend, and is now rebuilding from scratch.
Plan auth and payments before the fun part
The product took two days with Cursor, but auth, Stripe and webhook problems took weeks. The poster ends by recommending a boilerplate.
Handle failed payments and duplicate Stripe webhooks
The front end took a weekend, then Stripe webhook bugs, auth edge cases and slow queries took weeks. Note: it was posted by an account named after the starter tool the post ends up promoting.
Keep agents away from your production database
With auto-run enabled, a reset command wiped the builder's production database. They recovered from a VM snapshot and then added staging, approvals, backups and monitoring.
Keep Cursor updated against prompt injection
Security news reported critical Cursor flaws where prompt injection could escape the sandbox and run commands.
Scope agent credentials so they can't delete production
A car-rental software founder says a Cursor agent called the Railway API with a token it found and deleted a volume holding production data and its backups. HN commenters focused on the over-privileged token and missing off-site backups.
Use Supabase MCP read-only and away from production
Researchers showed that a prompt hidden in a customer support ticket could make a coding agent, running Supabase MCP with the service_role key, read private tables and post them back into the ticket.
Harden a vibe-coded app before launch
A builder shipped a Lovable/Cursor + Supabase app in three days. Researchers then wrote to the database via a Postgres view that bypassed RLS, and created accounts through Supabase Auth sign-ups that were never switched off.
Check rules files for hidden instructions
Pillar Security showed invisible Unicode in AI rules files could quietly instruct Copilot and Cursor to insert malicious code.