TL;DR
This 15-item checklist covers the most common security issues in Cursor-generated projects. 5 critical items must be fixed before launch, 6 important items within the first week, and 4 recommended items when you can. Print this page to use as a physical checklist during code review.
Quick Checklist (5 Critical Items)
API Keys and Secrets 5
Authentication 4
Database Security 3
Input and Output 3
How to Use This Checklist
Go through each item before deploying your Cursor project. If you find an issue, fix it before moving on. Some items may not apply to your specific project (for example, file uploads if you don't have that feature).
For the most thorough security review, combine this checklist with an automated security scan. Automated tools can catch issues that are easy to miss in manual review.
What should I check before deploying a Cursor project?
Before deploying a Cursor project, check for hardcoded API keys, verify .gitignore includes .env files, ensure authentication is implemented on both frontend and backend, test database access controls, validate user inputs, and run an automated security scan.
How do I find exposed API keys in my Cursor project?
Search your codebase for common patterns: sk_, pk_, api_key, apiKey, secret, password, and token. Also check browser DevTools Network tab to see what credentials are being sent with requests. Any key visible in the browser is exposed.
Do I need all items on this checklist?
Most items apply to any web application. Some may not apply to your specific project. For example, if you don't have user authentication, skip the auth section. But if your app handles any user data, all sections are relevant.
Automate This Checklist
Our scanner checks all these items automatically and catches issues you might miss.
Start Free Scan