Cursor Origin is on by default. Confirm your code-host posture this week.

Cursor Origin is not an autocomplete setting. It is a git host that sits next to the editor: repositories, pull requests, browsing, and agents that can work those repos without a round trip through GitHub. It started rolling out to paid plans last week. Enterprise admins can opt out. That sentence is doing more work than most rollouts deserve.

I am not writing this as a Cursor review, and I am not writing it for one industry. This is software engineering. If your company pays for Copilot or Cursor, you now have a code-host decision on the table — the same class of decision as “do we keep GitHub as the system of record?” If nobody confirmed the admin default this week, the vendor already answered it for you. The commercial version of that work is AI coding platform governance. What follows is the 48-hour version you can run yourselves.

Origin is a forge. Treat it like one.

For most of the last fifteen years, where code was written and where code lived were different products. GitHub (or GitLab, or Bitbucket) owned the remote. The IDE owned the buffer. AI coding tools spent 2023–2025 collapsing the writing side. Origin is the first widely used attempt to collapse the hosting side into the same product the agents already live in.

That can be a good architecture for agent-scale work. It is still a forge. Forges have identity, branch rules, audit export, subprocessors, and training terms. GitHub’s answers to those questions are imperfect and well documented. Origin’s answers, as of this week, are thinner: early beta, GitHub sync with GitHub remaining source of truth for repos that started there, and an explicit note that enterprise orgs can disable it. Coverage this week also pointed out that Origin-specific retention, residency, and training language has not caught up to the feature. You do not need to wait for a perfect white paper to decide whether a second copy of production IP belongs there.

The GitHub outage the same morning was a coincidence, not a procurement event. Availability is an engineering problem. Data terms and defaults are a control problem. Do not let a six-hour incident rewrite where your source of record lives.

The 48-hour checklist

You do not need a six-week program. You need a written posture before Friday. Have engineering and security in the same room. If legal owns customer IP language, bring them for item four.

1. Confirm the default. In the Cursor (or equivalent) admin console, is Origin enabled for the organization? Paid seats shipped opt-out for enterprises, not opt-in. Screenshot the setting. If you cannot find the control, assume it is on until an admin proves otherwise.
2. Inventory what already synced. Which GitHub organizations and repositories were connected? Who claimed a codebase name? Origin-native repos (created in Cursor, never born on GitHub) are a separate bucket — they do not inherit “GitHub stays source of truth.”
3. Name the system of record in one sentence. Example: “GitHub.com org X is canonical; Cursor Origin is not an approved remote for production IP.” Put it in the engineering handbook the same day. Verbal agreement in Slack is not a control.
4. Read the contracts you already signed. Customer MSAs, SOC 2 narratives, and employee IP agreements often constrain where source may be stored and which vendors may train on it. If Origin’s terms are unpublished or inherited from a generic privacy mode, that is a gap, not a maybe.
5. Match identity to GitHub. Synced repos that inherit GitHub visibility can still surprise you: a private GitHub repo that one person synced is not automatically visible to the team the way GitHub org membership is. The inverse is worse — loosening visibility on the mirror to “make agents useful” without the same SSO and required reviewers you enforce on GitHub.
6. Pause Origin-native production repos. Until terms, audit export, and branch protection are good enough for your bar, do not let a product repo exist only at a cursor.com/codebase/… URL. A backup during a GitHub incident is a clone you already control, not a new host you have not reviewed.
7. Write the questionnaire answers. “We use Copilot / Cursor as an editor; GitHub remains the system of record; Origin is disabled / scoped to non-production sandboxes.” If you cannot say that honestly, do not ship the old answer to the next enterprise security packet.

If that list is more than your team will finish this week, that is the signal to bring in a platform governance review — senior engineers, written posture, then a Copilot and Cursor code audit on the repos that already moved.

Keep GitHub as system of record until the terms exist

Cursor’s own model for GitHub-connected repos is the right default for most product companies: pushes still go to GitHub; Origin is a working copy next to the agents. That is a convenience layer. Treat it as a convenience layer. Do not treat two-way comment sync as “we have two equally governed forges.”

What GitHub still wins on, for most of our clients, is boring: org SSO, required reviewers, CODEOWNERS, audit logs you can ship, secret scanning, and a decade of questionnaire language. Origin may get there. Beta plus opt-out is not “there.” CIOs quoted in the trade press this week said the same thing in longer words: keep GitHub canonical, trial a new host on low-risk sandboxes, expand only when enterprise controls exist.

If your actual pain is GitHub availability, solve availability: mirrored remotes you operate, runbooks, status communication. Do not solve a reliability ticket by relocating the crown jewels onto a host whose data terms you have not read.

This is not an AI-code-quality post

We already published how to audit Copilot and Cursor output. That work still matters. It answers “what merged.” This week’s work answers “where the remote is.” Mixing them in one Slack thread is how both get skipped.

Platform governance is the policy: approved editor, approved host, who can enable a mirror, what happens when GitHub is down. Code audit is the diff: secrets, authz gaps, hallucinated packages, tests on the paths agents touched. Most teams that moved fast on AI coding tools now owe both. Neither is a healthcare-only problem. It is the same control conversation whether you ship a SaaS billing engine, an internal platform, or a mobile product.

What to tell the board

Keep it to four lines:

• Our AI coding vendor shipped a code host. It is on unless we opt out.
• GitHub remains our system of record unless this board (or the CTO with legal) changes that in writing.
• We will confirm admin state, inventory synced repos, and freeze Origin-native production remotes this week.
• We will update the AI-tools and source-control answers in the next security questionnaire so they match the console, not last year’s policy PDF.

If you want that written by people who have had to defend toolchain decisions in diligence — not as a slide, as an engineering artifact — start with AI coding platform governance. If the next question is the code those tools already wrote, use the Copilot and Cursor audit or ongoing oversight.

I write from the seat of a working engineering company, not a tool vendor. More at antoniochagoury.com.