Shift-Left Security Is Dead When Cursor Writes the Code

TL;DR Shift-left security worked because moving a check earlier in the pipeline meant the developer still remembered the code when the finding arrived. AI code generation broke that link. Pre-commit is the earliest stage traditional tooling can reach, and it now fires hundreds of generated lines too late. The fix is not a faster pipeline. It is running the check inside the generation loop, before you accept the suggestion. I shipped a Stripe webhook handler last month that Cursor wrote in about…