Is my Cursor app secure? A security checklist for Cursor-built apps
Cursor doesn't host your app, choose your database, or wire up your payments for you — you do, with an AI reading your prompts. That means more can go wrong silently, because more of it was ever a decision at all.
Why Cursor apps drift differently than hosted-builder apps
A hosted builder makes most of your infrastructure decisions for you — one auth system, one database setup, one deploy path. Building in Cursor (or another code editor with an AI assistant) means you’re assembling those pieces yourself, one prompt at a time, across whatever stack you chose. That’s not worse — it’s just a different shape of risk: instead of a few platform-wide gaps, you get an accumulation of small, individually reasonable choices that nobody reviewed together.
Mistakes that show up specifically in Cursor-built apps
- A service-role Supabase key in an API route. Asking an AI assistant to “fix the permission error” on a Supabase call is a very common way for the full-access key to end up in server code that later gets copied into a client-callable route, or logged somewhere it shouldn’t be.
- No rate limiting, because nobody asked for it. An AI assistant builds what the prompt describes. “Add a login page” rarely includes “and make sure it can’t be hit a thousand times a minute,” so it usually isn’t there unless someone specifically asks.
- Authorization checked in a component, not a route handler. Hiding an admin button for non-admins is a UI decision; checking that the request itself is from an admin is a server decision. It’s easy to ship the first and assume it covers the second.
- Stripe webhook signature verification skipped during a quick integration. It’s genuinely more fiddly to wire up than the “happy path” webhook handler, and the happy path works fine in testing without it.
A manual checklist for a Cursor-built stack
- Grep your entire repo for the string 'service_role' and confirm every match is in a file that never ships to the browser.
- Open your deployed app's dev tools, hit your login endpoint 20 times in a row, and see whether anything ever blocks or slows you down.
- For every route that checks 'is this user an admin', confirm the check runs on the server, not just in the component that renders the button.
- Confirm your webhook route reads the raw request body and verifies a signature before parsing it as JSON.
What Deep Scan adds beyond this list
These are the mistakes a five-minute pass can catch by inspection. The ones that require actually trying something — a second account, a forged webhook, a paywall bypass — need the checks below, run against your live app rather than your source:
See what a full scan of a Cursor-built stack actually finds.
The sample report is a real scan of a deliberately vulnerable app — nine findings, the proof behind each one, and what they would cost.