Cursor Hooks for QA: Audit Log, Secret Scan & Safe Test Databases

The AI changed your test, but did anyone check it? In this Cursor hooks tutorial for testers, I explain what hooks are (small scripts that run automatically at moments in the agent loop), before vs after hooks, the 5 hook moments testers need, hooks.json, JSON in and out, exit codes, matchers, failClosed and prompt hooks. Plus an audit log hook, blocking risky commands, and examples for manual, API, performance and automation testing. This is Episode 12 of The Cursor-Powered Tester, a Cursor AI for testing series on Automate With SDET. You'll learn: ✅ What Cursor hooks are ✅ Before vs after hooks (and why edit hooks run after the edit) ✅ The 5 hook moments for testers ✅ hooks.json: project vs personal ✅ JSON in/out, exit codes, matchers and failClosed ✅ Prompt-based hooks ✅ An audit log hook and a block-risky-commands hook Chapters 0:00 Intro: nobody checked 1:09 Episode 11 recap 1:30 What a hook is 2:06 What hooks can do 2:41 Before and after moments 3:28 5 hook moments for testers 4:04 Where hooks live (hooks.json) 4:38 The file format 5:10 How a hook talks: JSON 5:47 Exit codes + failClosed 6:22 Matchers 6:50 Prompt hooks 7:22 Quick quiz 7:59 Your first hook: audit log 8:37 Blocking a risky command 9:15 Example: manual testing 9:51 Example: API testing 10:24 Example: performance testing 10:55 Example: automation testing 11:30 Before / after hooks 11:54 Hooks + subagents 12:21 Troubleshooting 12:50 Safety 13:22 Best practices 13:51 Cheat sheet 14:29 Recap 14:54 Homework + next: several agents at once Links Hooks (Cursor documentation): https://cursor.com/docs/hooks Title note: edit hooks (afterFileEdit) run after the edit, so they check changes rather than stop them; before-hooks can block shell commands, MCP tools and file reads. Features, menus, plans and prices are as described at the time of recording (October 2026) and can change. Screens in this video are illustrations, not exact screenshots. Follow your company's policy before using AI tools on work data, and never paste real customer data into a prompt. Previous episode: Cursor Custom Commands for Testers (Ep 11) Next episode: Running several agents at once for testers (Ep 13) Subscribe to The Cursor-Powered Tester on Automate With SDET. Instagram: @automatewithsdet #CursorHooks #CursorAI #Hooks #AIAgents #CursorAgent #AISafety #DevSecOps #CursorAITutorial #CursorAIForTesting #CursorForTesters #TheCursorPoweredTester #AIinTesting #QATesting #SoftwareTesting #TestAutomation