Static analysis—a widely deployed form of automated security testing—is typically rule-based, meaning it matches code against known vulnerability patterns. That catches common issues, like exposed passwords or outdated encryption, but often misses more complex vulnerabilities, like flaws in business logic or broken access control.
Rather than scanning for known patterns, Claude Code Security reads and reasons about your code the way a human security researcher would: understanding how components interact, tracing how data moves through your application, and catching complex vulnerabilities that rule-based tools miss.
Every finding goes through a multi-stage verification process before it reaches an analyst. Claude re-examines each result, attempting to prove or disprove its own findings and filter out false positives. Findings are also assigned severity ratings so teams can focus on the most important fixes first.
Validated findings appear in the Claude Code Security dashboard, where teams can review them, inspect the suggested patches, and approve fixes. Because these issues often involve nuances that are difficult to assess from source code alone, Claude also provides a confidence rating for each finding. Nothing is applied without human approval: Claude Code Security identifies problems and suggests solutions, but developers always make the call
Claude Code Security is intended to put this power squarely in the hands of defenders and protect code against this new category of AI-enabled attack. We’re releasing it as a limited research preview to Enterprise and Team customers, with expedited access for maintainers of open-source repositories, so we can work together to refine its capabilities and ensure it is deployed responsibly.
Claude Code Security is intended to put this power squarely in the hands of defenders and protect code against this new category of AI-enabled attack. We’re releasing it as a limited research preview to Enterprise and Team customers, with expedited access for maintainers of open-source repositories, so we can work together to refine its capabilities and ensure it is deployed responsibly.
Databases:
Turbopuffer: a multi-tenant database used to store encrypted files and the Merkle Tree of workspace, covered below. The team prefers this database for its scalability, and not having to deal with the complexity of database sharding, like previously. We cover challenges in “Engineering challenges”, below.
Pinecone: a vector database storing some embeddings for documentation
Data streaming:
Warpstream: an Apache Kafka compatible data streaming service
Thanks with multiple hearts ♥️
A software system is made up of one or more containers (applications and data stores), each of which contains one or more components, which in turn are implemented by one or more code elements (classes, interfaces, objects, functions, etc). And people (actors, roles, personas, named individuals, etc) use the software systems that we build.
Cursor may be catching up with GitHub Copilot in revenue generation: Reuters reports GitHub Copilot likely generated $500M in revenue in 2024. Currently, Cursor is on track to generate the same in 2025, or even more if growth continues at the current pace.
1. Tech stack
Some stats about the barely-3-years-old codebase behind Cursor:
25,000 files
7 million lines of code
The editor is a fork of Visual Studio Code, meaning it has the same tech stack as VS Code:
Ask somebody in the building industry to visually communicate the architecture of a building and you’ll be presented with site plans, floor plans, elevation views, cross-section views and detail drawings. In contrast, ask a software developer to communicate the software architecture of a software system using diagrams and you’ll likely get a confused mess of boxes and lines … inconsistent notation (colour coding, shapes, line styles, etc), ambiguous naming, unlabelled relationships, generic terminology, missing technology choices, mixed abstractions, etc.
Test web review. Test web review. Test web review. Test web review. Test web review. Test web review. Test web review. Test web review.
Hello. Another test reply
Note that bootsnap writes to tmp/cache (or the path specified by ENV['BOOTSNAP_CACHE_DIR']), and that directory must be writable. Rails will fail to boot if it is not. If this is unacceptable (e.g. you are running in a read-only container and unwilling to mount in a writable tmpdir), you should remove this line or wrap it in a conditional.
Note also that bootsnap will never clean up its own cache: this is left up to you. Depending on your deployment strategy, you may need to periodically purge tmp/cache/bootsnap*. If you notice deploys getting progressively slower, this is almost certainly the cause.
Test reply 3
Controllable input metrics are exactly as described: they are directly actionable (hence ‘controllable’), and they impact some output metric you care about (hence the name ‘input’). Examples include some of the metrics discussed in the previous section, like “Add 500 new products to the Musical Instruments category of Amazon.com.fr (100 in Q1, 200 in Q2 …)” or “Run at least 20 newsletter ads per month.”
Output metrics are metrics that you ultimately care about. These are things like ‘number of engaged users’ or ‘revenue’, or ‘absolute dollar free cash flow’, or ‘contribution profit’ or ‘DAU/MAU ratio’. You are not allowed to discuss output metrics during the WBR, except in a reporting sense — the way to hit your output metric targets is to seek out controllable input metrics for each of your output metrics and drive those.
