Signals planned: model card presence, training data disclosure, published red-team results. Some checks will be partially automated via website scanning; others require vendor submission.

Security hygiene & transparency20/28 pts

security.txt

security.txt file found

Contact field present+2

Expires field present0/2

Encryption field present0/1

Security headers

Content-Security-Policy header+3

X-Frame-Options header0/2

X-Content-Type-Options: nosniff0/2

Referrer-Policy header0/1

Source: response headers from cursor.sh · Scanned 9/6/2026

Disclosure policy

Security disclosure page found+3

Page references vulnerability reporting+2

Source: cursor.sh/security · Scanned 9/6/2026

HTTPS + HSTS

HTTP redirects to HTTPS+3

HSTS header enforced+2

Source: response headers from cursor.sh · Scanned 9/6/2026

Trust page

Public trust/security page found+5

Incident historypending

Signals planned: breach-history lookup, incident response quality assessment. This category is coming soon.

Verification bonus+0/5 bonus pts

Claimed profile

Domain ownership verified by claiming the profile0/5

Rubric v1.3.0 · 20/28 implemented pts · click a category to see details

Current:Good

With verification:Excellent(+6pts)

Claim this profile to improve your grade →

Add a PGP Encryption: field to /.well-known/security.txt to earn +1pt.

Score history (5 updates)

↑ improving

v1D+ → B+ → C → B → Bv5

Score history

Grade improved: C → B

Score +5pts (15 → 20)

trustPagePresence.found added (+pts)

Recomputed from already-known data, not a full rescan

9/6/2026

Grade dropped: B+ → C

Score -13pts (28 → 15)

9/6/2026

Grade improved: D+ → B+

Score +13pts (15 → 28)

9/3/2026

Scanned 3d ago

Certifications & disclosures

Something look wrong? Signed-in users can flag a certification below — an Entropy admin reviews every report.

Unverified
ISO 27001
Discovered at cursor.sh on 9/6/2026, not vendor-confirmed
Unverified
ISO 42001
Discovered at cursor.sh on 9/6/2026, not vendor-confirmed
Unverified
SOC 2 Type II
Discovered at cursor.sh on 9/6/2026, not vendor-confirmed
Found
security.txt
Discovered at cursor.sh/.well-known/security.txt on 9/6/2026

AI models used

Self-disclosed · unconfirmedClaude (Anthropic)Gemini (Google)GPT-5 (OpenAI)Grok (xAI)

Found in cursor.sh’s llms.txt, captured by Entropy on 9/6/2026. Not vendor-confirmed — the vendor can confirm or correct this from their dashboard.

Show what we found

Claude (Anthropic) — “- https://cursor.com/docs/models/claude-sonnet-5.md” (llms.txt)
Gemini (Google) — “- https://cursor.com/docs/models/gemini-3-1-pro.md” (llms.txt)
GPT-5 (OpenAI) — “- https://cursor.com/docs/models/gpt-5-6-sol.md” (llms.txt)
Grok (xAI) — “- https://cursor.com/docs/models/grok-4-6.md” (llms.txt)

View the full llms.txt snapshot Entropy captured →