“Connected as ‘my github username’ to repositories in GitHub organizations: X” where X is someone else’s github username: yy******
I’ve censored the username because it appears to be someone’s personal github account.
If I connect to additional organizations under my github account, then additional organizations will be added to the list, but the unknown user still appears connected.
Steps to Reproduce
Connect background agents to github organizations.
Expected Behavior
Background agents should only connect (and list connections) to organizations under my account that I specify.
Operating System
Windows 10/11
Current Cursor Version (Menu → About Cursor → Copy)
Well its true that I’m seeing what I reported. I’m reserving judgment on whether it indicates a serious security issue. Would be nice to understand why its appearing though. I’m having trouble coming up with plausible reasons how it could be an issue on my end, but the fact that other users haven’t reported it perhaps points in that direction.
I think I identified the issue, and it seems mostly benign.
The other user forked a private repository which I have access to, and that forked repository is the only repository under that user which appears accessible to the cursor background agent. Forks of private repositories on github copy permissions from the original repository to the fork.
I am not the owner of the private repository that was forked, and so initially didn’t see any obvious connection between myself and the other user.
The only odd thing, that might be considered a bug, is that I don’t see any way to opt-out of allowing cursor access to these forked repositories that my account has access to.
Fortunately, almost all of my projects are under github organizations (not my personal account), so it’s not a large issue for me. I confirmed that when I granted cursor access to a specific repository in an organization (that I know has forks) that neither the forked repos nor forking users/orgs appeared.