Shipped with Cursor? See what a stranger can see.
Cursor writes a lot of code fast, and secrets slip into places they should not be. We look at your deployed app the way an outsider would and hand you a prompt for Cursor Agent for every problem we find. The free scan shows your score and how many problems you have; the Full Scan adds the evidence, a fix prompt for each one, and the deeper checks (database, exposed files, HTTPS/TLS, email spoofing, admin panels) after you verify you own the app.
The 10 most common Cursor problems
Secret keys in the client bundle
A key such as OpenAI, Anthropic, Stripe live or GitHub ends up in front-end code, often after a quick test that never got moved to the server. The free scan checks this.
.env files that can be downloaded
A .env or .env.local file sits in a public folder or build output, so anyone can request it by its address. Part of the Full Scan.
Firebase left open
A Firebase Realtime Database that anyone can read is critical. Firestore collections or Storage buckets that anyone can list are high. Part of the Full Scan.
AWS access keys in the client bundle
An AWS access key ID in front-end code may give access to your AWS resources, and the secret half is often nearby. We rate this high. The free scan checks this.
Supabase tables anyone can read
A table that the public key can read without signing in. We rate this high, and critical when the table holds personal or payment data. We only count rows. Part of the Full Scan.
API routes that forgot the session check
A route found in your bundle returns user-like data (emails, tokens, roles) to someone who is not logged in. Part of the Full Scan.
A public .git folder
Your source code and its full history, including old secrets, can be downloaded from the live site. Part of the Full Scan.
Outdated JavaScript libraries
An old copy of a library such as jQuery, Bootstrap, AngularJS, Lodash, Moment.js or Handlebars with a publicly known security flaw, found in your page or its JavaScript files. The free scan checks this.
Weak HTTPS or email protection
HTTP that does not redirect to HTTPS, a certificate that is about to expire (rated high if it is not trusted or already expired), a missing SPF or DMARC email record (so anyone can send email that looks like it came from your domain), or an admin login page open to the public. Public source maps are reported too, as low. Part of the Full Scan.
Missing security headers
No Content-Security-Policy, HSTS or clickjacking protection. Low risk on their own, but easy to add, and they make other bugs harder to exploit. The free scan checks these.
How to fix them in Cursor
- 01Run a free scan to see your score, then get the Full Scan for the location and a fix prompt for each red item.
- 02Pick Cursor in the fix-prompt switcher and copy the prompt for each red item.
- 03Paste it into Cursor Agent with your project open, and read the diff before you accept it.
- 04Rotate any key that leaked in the provider’s dashboard. Removing it from the code does not un-leak it.
- 05Redeploy and re-scan until the light is green.
Doesn’t Cursor already check this?
Cursor helps you write and review code inside your editor, which is a view from the inside. Greenlight Scan looks at what is actually deployed, from the outside, so it catches things like a stray .env in the build folder that the editor never sees. Use both.
Full comparison →Questions
Do you need access to my repo or Cursor account?
No. The scan only needs your deployed app’s public address. Reading your GitHub repo is a separate, optional part of the Launch Audit.
Which frameworks does it work with?
Any site that is reachable on the web. We look at the page, its JavaScript files and a few well-known paths, so it works for Next.js, Vite, React and plain sites alike.
Will the fix prompts work in Cursor?
Each prompt is written to be pasted into Cursor Agent. It tells Cursor what is wrong, where we found it and what to change, and asks it to show you the diff first.
What does the free scan check, and what needs the Full Scan?
The free scan is passive. It reads what any browser downloads and checks it for leaked keys, security headers, cookie flags, mixed content and outdated JavaScript libraries. It shows your score, how many problems of each severity were found, and the title and why-it-matters of your top problem; the evidence, location and fix are hidden. The Full Scan unlocks every finding and fix prompt, and, after you verify you own the app, adds database and storage access, exposed files such as .env or .git, API routes that answer without login, Firebase rules, HTTPS and TLS certificate checks, SPF and DMARC email protection, open admin panels and public source maps.