This is the current behavior by design. Plans are saved to your user directory (~/.cursor/plans) by default, and there’s no setting to change that location.
As a workaround, you can use the “Save to Workspace” button at the top of an open plan, which moves it into your project’s .cursor/plans/ directory. From there, it can be committed to version control and shared with your team. More on that here: Best practices for coding with agents.
Making the default plan location configurable (per-project) is one of the most requested features on the forum. You can add your vote to the existing request here: Option to save Plans in project-level .cursor directory.
Your points about security and multi-user access are well taken, especially in an enterprise context.