Cursor

Install Cursor and import your VS Code profile

Go to cursor.com → Download (macOS, Windows, or Linux — all supported). The installer takes 2-3 minutes.

On first launch, Cursor asks: Import VS Code settings? Click Import. This copies your extensions, themes, keybindings, and settings file. You are in a familiar environment from minute one — no reconfiguration needed.

Verify the import: check your theme is correct (Ctrl/Cmd + K → T), open Extensions panel (Ctrl/Cmd + Shift + X) to confirm your extensions transferred, and test a keybinding you use frequently.

Configure your AI models and Privacy Mode

Open Cursor Settings: Cmd/Ctrl + Shift + J → click the Models tab.

Enable the models you want. Recommended setup:
• claude-opus-4-5 — best for complex reasoning, architecture, and long context
• gpt-5.5 — best for creative code and rapid iteration
• gemini-3-pro — use when you need 1M token context for giant codebases

If your codebase contains proprietary code, sensitive data, or customer information: enable Privacy Mode on this screen. This prevents your code from being stored or used in model training — a critical requirement for enterprise and regulated environments.

Open your project: Cmd/Ctrl + O → select your project folder.

Have your first conversation with your codebase

Open the AI Chat: Cmd/Ctrl + L.

Do not start by writing code. Start by asking questions to build your understanding:

Walk me through the architecture of this codebase. What does it do, what is the entry point, how does data flow through the system, and what are the main layers (API, business logic, data)?

Then drill down:
Where is user authentication handled? Show me the files involved and explain how the JWT token validation chain works from the route to the middleware.

Type @codebase in your message to perform a semantic search across all files. Type @filename.ts to reference a specific file directly. Cursor reads your actual code — not generic documentation — and answers based on YOUR specific implementation.

Build your first feature with Composer

Composer implements features across multiple files simultaneously. Press Cmd/Ctrl + I to open it.

Write a specific, complete feature description. Include your stack and constraints:
Add rate-limited email verification to the user registration flow. Requirements: POST /auth/send-verification accepts an email, generates a 6-digit OTP, stores it in Redis with 10-minute expiry, and sends it via the existing EmailService. Rate limit: max 3 requests per email per hour — return 429 if exceeded. Return 422 for invalid email format, 400 for missing fields. Add 5 Jest unit tests: valid request, rate limit exceeded, invalid email, OTP expiry after 10 minutes, and resend before expiry. Follow the existing controller/service/repository pattern in the codebase.

Composer reads your codebase, plans the implementation, writes all files, and shows a unified diff. Review each file, then accept or reject.

Create your .cursorrules file

Create a file named .cursorrules in your project root directory. Cursor reads this file on every request and applies it automatically — no need to repeat your conventions in every prompt:

# Tech Stack
- Node.js 22 + TypeScript strict mode
- Express 5 + Prisma ORM + PostgreSQL
- Jest + Supertest for testing
- Zod for all input validation (never manual checks)

# Architecture Rules
- Controllers: HTTP layer only — no business logic
- Services: all business logic
- Repositories: all database queries (Prisma calls here only)
- Routes: define paths and middleware only

# Code Standards
- All exported functions: JSDoc with @param and @returns
- No 'any' type anywhere — always type explicitly
- Prefer early returns over nested if/else
- Tests mirror src/ structure in __tests__/

# Forbidden
- Never console.log in production (use logger service)
- Never expose stack traces in API responses
- Never hardcode credentials or secrets

Fix failing tests autonomously with the Agents Window

Run your test suite:

npm test

Deploy your first AI-built feature to production

Before deploying, ask Cursor for a production readiness review. Open Chat and type:
Review all the changes made to the codebase since the last git commit for production readiness. Check for: 1) security issues (exposed API keys, missing input sanitization, auth bypass risks), 2) unhandled error cases that could cause 500 errors, 3) N+1 database query patterns, 4) console.log statements left in production code, 5) missing environment variable definitions, 6) breaking changes to existing API contracts. Output as a numbered checklist with severity labels (Critical/High/Medium/Low).

After resolving every Critical and High item:

# Run full quality checks
npm test && npm run typecheck && npm run lint

# If all pass, commit and push
git add -A
git push origin main