Security scan for apps built with Cursor: the mistakes AI code makes

The 6 most common issues in Cursor-built apps

1. Hardcoded or committed secrets. An API key pasted into a file "just to test", or a .env committed to git. Deleting it later doesn't help, because it stays in the git history. See Exposed secrets & API keys.
2. Secrets in public variables. Anything prefixed NEXT_PUBLIC_, VITE_, REACT_APP_ or EXPO_PUBLIC_ ships to every visitor's browser. See Supabase service_role key exposed in the browser.
3. API routes with no auth check. The route works when you test it while signed in, but it never checks the session, so anyone can call it. See Missing auth on admin routes.
4. No ownership check (IDOR). /api/orders/123 returns order 123 to any signed-in user, not just the one who owns it. See IDOR.
5. Trusting the client. The price, plan, credits or role come from the request body instead of the server or database. See Client-trusted prices.
6. Vulnerable dependencies. Packages with known vulnerabilities, often older versions copied from examples. See Vulnerable dependencies.

How to check your app yourself

1. Search the repo for sk_, sk-, secret, service_role and api_key, and check that .env is in .gitignore.
2. List every environment variable with a public prefix and make sure none of them is a secret.
3. Open each API route or server action and confirm it checks the session and that the user owns the record.
4. Find every place money or plans are handled and make sure the amount comes from the server.
5. Run npm audit (or your package manager's equivalent).

Tip: give Cursor a security rule

Add a rule in .cursor/rules so Cursor checks its own work, for example: "Every API route and server action must verify the session and that the user owns the record. Never trust prices, roles or user IDs from the client. Never put secrets in public env variables or in code."

How to scan it with SetRepo

1. Connect your GitHub repo (read-only access) or upload a zip. Add your live URL if the app is deployed.
2. Run a free Quick scan: secrets in code and git history, vulnerable dependencies, risky code patterns, route-level access control, Supabase and Firebase rules, and your live site's HTTPS and security headers.
3. The free report shows every finding's title and severity, with full details for the top few. A Deep scan unlocks every finding with a fix prompt you can paste into Cursor's chat.
4. A Deep scan also adds an AI review of access control and business logic, the kind of bug that pattern matching can't catch.

FAQ

Does it matter which language or framework I used?

Cursor can generate any stack. SetRepo is built for web apps. Its code rules cover Python, JavaScript and TypeScript, Go, Ruby, PHP, Java and other JVM languages, C#, Rust and Dart, and its access-control check maps the server routes of frameworks like Next.js, Express, NestJS, FastAPI, Django, Rails, Laravel, Spring and Gin, plus Supabase Edge Functions and Supabase and Firebase rules. Injection checks such as SQL injection and XSS go deepest in Python and JavaScript/TypeScript. Each report lists what it couldn't check. Details: Accuracy.

Does SetRepo store my code?

No. Your files are deleted when the scan finishes, and findings keep secret values only as [REDACTED]. The one exception: a zip from a finished Quick scan is kept for up to 24 hours so you can upgrade it to a Deep scan, then deleted. Details: Security.

Will it change my repo?

No. GitHub access is read-only.

What does it cost?

The Quick scan is free with no credit card. A Deep scan is a one-time payment, and there are monthly plans if you scan often. See pricing.