Changelog

New features, fixes and changes to Cursor, newest first.

October 2026

Bulk release for raid detainments

When a raid floods your queue, release the detainees who only matched on IP in one bulk action.

Pick every detainee with a single weak signal and release them together.
Bans still need two matching signals, so a bulk action never sends an unverified ban.
Each action lands in the log channel with the staff account that ran it.

Detainment now shows which signals matched

Detainees arrive with the evidence attached, so you can decide without digging through logs.

Every detained account lists the device, IP and browser checks that flagged it.
The matched account and the date it was banned appear next to each signal.
Signals are ordered strongest first, so the reason for the detention is the first thing you read.

Household IPs no longer flag members as alts

Members behind a shared connection were being detained on IP alone. That's fixed.

An IP match no longer triggers detention by itself — a device or browser signal has to agree with it.
VPN and hosting ranges are still flagged for review.
Anyone detained before the change stays in your queue so you can review them.

September 2026

Faster restores on large servers

Restores add members in bigger batches and report progress while they run.

Servers over 10,000 members restore noticeably faster.
The log message updates as each batch completes.
Revoked authorizations are reported separately from members waiting on rate limits.

VPN detection covers more IPv6 ranges

A gap in our range data meant some VPN addresses were treated as residential.

Added IPv6 ranges for the larger commercial VPN providers.
Hosting ranges are now labelled separately from VPNs, so a datacentre IP reads as one.

August 2026

Device signatures refresh on every verification

Signatures update when a member verifies again, so a reinstalled browser doesn't hide a returning account.

Re-verification replaces the stored signature instead of adding a second one to the account.
Signatures untouched for 90 days are dropped, keeping the comparison set small and fast.

OAuth2 tokens encrypted at rest

Restore tokens are encrypted at rest and revoked the moment a member asks.

Tokens are encrypted with keys rotated on a schedule.
A revocation request removes the token immediately: the member stays verified, but can no longer be restored.