Security Agents: "trigger needs a branch selected" but no branch selector exists in the UI

Support Bug Reports
,
1

Where does the bug appear (feature/product)?

Bugbot / Security Review Agent

Describe the Bug

The built-in Vulnerability Scanner security agent (Cursor web dashboard → Automations → From Cursor → Security Agents → Vulnerability Scanner) cannot be created. Clicking “Create Agent” always fails with a red banner: “The ‘Every week’ trigger needs a branch selected.” (or “The ‘Every day’ trigger needs a branch selected.” for the default daily schedule) - but the page never renders any branch selector, so there is nothing to click to satisfy the validation.

What I checked:

  • The trigger row only has day/time controls - no branch field
  • The Repo scope “Configure” and organization dialogs only contain enable/disable checkboxes - no branch
  • Inspected the DOM/accessibility tree: no branch selector element exists anywhere on the page
  • A Custom (cron) weekly expression (0 9 * * 1) gets normalized back into an “Every week” trigger and fails identically
  • The environment dropdown next to Discard only offers “Cloud” - no branch there either
  • The generic New Automation editor is NOT affected: it shows repository + branch pickers in the header and weekly triggers attach fine, so this seems specific to the “From Cursor” security agent template pages

Environment: Cursor web dashboard, Chrome on macOS, team account, tested 2026-08-04.

Steps to Reproduce

  1. Go to the Cursor web dashboard: Automations → Security Agents → Vulnerability Scanner
  2. Repo scope: GitHub connected, 1 org / 1 repo enabled via Configure
  3. Keep the default “Every day at 11:00” trigger, or switch to Every week
  4. Click “Create Agent” → red error banner: “The ‘…’ trigger needs a branch selected.” and no branch selector exists anywhere on the page to fix it

Expected Behavior

A branch picker should be available somewhere on the page (trigger row, repo scope, or header), or the validation should not require a branch and instead default to the repository’s default branch. For comparison, the generic New Automation editor shows repository + branch pickers in its header and weekly scheduled triggers save fine there - only these “From Cursor” security agent template pages are missing the control.

Operating System

MacOS

Version Information

Cursor web dashboard (Chrome) - not IDE-specific; bug is in the Automations / Security Agents web UI

Does this stop you from using Cursor

No - Cursor works, but with this issue

7

Hey there!

Workaround: In Repo scope → Configure, enable at least two repositories, then click Create Agent again. With two or more repos selected, that branch check is skipped and each repo scans on its default branch. If you only care about one repo, you can enable a second unused repo just to get past create (or keep using the generic New Automation editor, which has the branch picker as you already found).

We’ve let the team know and this is an issue we’re tracking. I’ll post here when there’s an update.

8

thank you @mohitjain this workround worked! :palms_up_together: