Rollouts and Security Review
By Steven Van ·
Rollouts monitors deploys per environment and Security Review scans every PR for exploitable bugs, both free to try with limited-time credits.
Cursor is launching two bots for the last mile of shipping code: Rollouts, which watches a change as it deploys, and Security Review, which checks every pull request for exploitable bugs. Both are available today on Teams and Enterprise plans.
Rollouts
Rollouts attaches a monitor to every pull request and reports change health per environment as one of three verdicts: verified healthy, regression detected, or inconclusive. It's the Cursor version of Firetiger Change Monitors, rebuilt on the Bot Development Kit. Enable it from the dashboard and connect source control, your deploy system, and your telemetry provider; it starts watching on the next pull request.
When a pull request opens, Rollouts reads the diff and writes a monitoring plan as a PR comment: the risks it identified, the change's intended effect, the signals it will check, and any instrumentation gaps. Authors can edit the plan and Rollouts uses their version. On deploy, it wakes for the change's commit and runs the plan against logs, metrics, and traces, tracking each environment separately so a change can verify in staging and still get flagged in production. If it detects a regression, it names the suspected change and notifies the author, and depending on configuration can open a revert PR for review or hand the finding to a cloud agent for a fix; it does not merge or roll back on its own. Rollouts connects to Origin or GitHub for source control, to CD systems for deploy events, and to Datadog and other telemetry providers for signals. Feature flag integration is coming soon.
Security Review
Security Review reads every pull request in the context of the codebase and posts one review comment reporting exploitable bugs; style and quality checks stay with Bugbot. Enable it from the dashboard per repository. Draft PRs are skipped. It looks for:
- Injection across SQL, command, and template surfaces
- Authentication and authorization bypasses, including checks that a refactor stopped running
- Secrets and credentials committed to source
- SSRF and unvalidated redirects
- Unsafe deserialization
- Dependency changes that introduce known vulnerabilities
Each finding carries a severity, the attack path, and a proposed fix. Dismissing one with a reason stops it from being raised again on that PR. Teams can also add rules, such as which client external calls must go through or which tables are never queried from a request handler, and Security Review enforces them on every PR.
Both bots can be turned on from the automations tab. For the next 10 days, Cursor is including usage credits to try Rollouts on real changes: roughly 50 changes for Teams customers and 500 for Enterprise.
