# Does Cursor Support Locking Extensions with \`extensions.allowed\`?

**URL:** <https://forum.cursor.com/t/does-cursor-support-locking-extensions-with-extensions-allowed/116299>\
**Category:** Help\
**Created:** [July 10, 2025, 1:15pm UTC](https://forum.cursor.com/t/does-cursor-support-locking-extensions-with-extensions-allowed/116299 "2025-07-10T13:15:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![silverfox\_927](https://avatars.discourse-cdn.com/v4/letter/s/c67d28/32.png) [@silverfox\_927](https://forum.cursor.com/u/silverfox_927)\
**Post date:** [July 10, 2025, 1:15pm UTC](https://forum.cursor.com/t/does-cursor-support-locking-extensions-with-extensions-allowed/116299/1 "2025-07-10T13:15:29Z")

</div>

We are looking to prevent users (on macOS) from installing VS Code extensions that are not explicitly allowlisted, due to security concerns, particularly the risk of malware in third-party extensions.

Does Cursor support VS Code’s `extensions.allowed` setting in `settings.json`?

Ref: [Enterprise support](https://code.visualstudio.com/docs/setup/enterprise#_configure-allowed-extensions)

It doesn’t appear to have any effect in Cursor.

Additionally, enforcing this would likely require revoking write access to `settings.json`, which would also block users from customizing other preferences (e.g., themes).

Is there a better way to manage or lock down extensions in Cursor?

Thanks.

---

<div class="post-metadata">

**Author:** ![silverfox\_927](https://avatars.discourse-cdn.com/v4/letter/s/c67d28/32.png) [@silverfox\_927](https://forum.cursor.com/u/silverfox_927)\
**Post date:** [July 14, 2025, 5:37am UTC](https://forum.cursor.com/t/does-cursor-support-locking-extensions-with-extensions-allowed/116299/2 "2025-07-14T05:37:45Z")

</div>

This article highlights why this feature would be important:

> **[The Solidity Language open-source package was used in a $500,000 crypto heist](https://securelist.com/open-source-package-for-cursor-ai-turned-into-a-crypto-heist/116908/)**
>
> Kaspersky GReAT experts uncover malicious extensions for Cursor AI that download the Quasar backdoor and a crypto stealer.

Please advise!

---

<div class="post-metadata">

**Author:** ![david\_dykstra](https://avatars.discourse-cdn.com/v4/letter/d/779978/32.png) [@david\_dykstra](https://forum.cursor.com/u/david_dykstra)\
**Post date:** [October 10, 2025, 7:31pm UTC](https://forum.cursor.com/t/does-cursor-support-locking-extensions-with-extensions-allowed/116299/3 "2025-10-10T19:31:40Z")

</div>

According to [Enterprise Settings | Cursor Docs](https://cursor.com/docs/account/teams/enterprise-settings)

It should be supported.