Security Reviewer posts findings after marking them “discard”

Support Bug Reports
, ,
1

Where does the bug appear (feature/product)?

Bugbot / Security Review Agent

Describe the Bug

My Security Reviewer uses this exact custom instruction:

Read .github/security-review-prompt.md and apply it to this PR.

Post only confirmed, actionable findings. Add each finding as an inline comment on the relevant changed line. Do not post top-level comments, summaries, investigation notes, or rejected findings. If no confirmed finding exists, do not comment.

The reviewer examined several possible findings and marked five of them discard. It still published five inline comments. Every comment started with Security verification (discard). It also published a review summary that said the findings were not exploitable.

Steps to Reproduce

  1. Configure the Security Reviewer to publish only confirmed findings and to publish nothing when no confirmed finding exists.
  2. Trigger the Security Reviewer on a pull request.
  3. Let the reviewer examine and discard a possible finding.
  4. Observe whether it publishes the discarded finding.

Expected Behavior

If the final verdict is discard, the reviewer must publish no inline comment and no review summary.

Operating System

MacOS

Version Information

Cursor Web Security Reviewer, September 4, 2026

For AI issues: add Request ID with privacy disabled

Run ID: bc-39e06c55-80aa-4867-a189-f1f9b74a59a2
Automation ID: d0e475f8-d58d-4a86-a3bb-d90cfa54dfe6

Does this stop you from using Cursor

No - Cursor works, but with this issue

7

Hey @aprananda, thanks for the detailed report, and for the run and automation IDs.

This is on our side, not your config - the helper agents the Security Reviewer uses to double-check findings were able to post their own comments, which is why the “Security verification (discard)” comments and summary showed up even though the main reviewer had dropped those findings. Your custom instruction was applied to the main reviewer exactly as written.

We’ve let the team know and this is an issue we’re tracking, and we’ve already made a change on our side that should stop these stray comments. It’s safe to resolve or delete the existing ones, and you’re fine to re-enable the automation whenever you’d like - if you spot another, reply here and I’ll jump back in.