Cursor-generated code
Cursor Security Checklist Before You Launch
Cursor can accelerate implementation. This checklist helps you review the routes, data access, integrations, and deployment settings that need human verification before customers use the app.
0 OF 18 COMPLETE
Progress is saved only in this browser.
Check 01
Review the change, not just the chat summary
A coding assistant can describe a feature accurately while missing a sensitive route, a migration, or a configuration change. Read the final diff and trace every new request path.
Check 02
Do not let generated UI become a security boundary
Generated client code can hide controls, buttons, and pages, but a user can still invoke the underlying server endpoint directly.
Check 03
Trace generated database access end to end
Generated queries often look plausible without proving that tenant boundaries, row-level policies, and write permissions are correct.
Check 04
Check integrations where trust changes hands
Payments, email, storage, OAuth, and webhooks cross from your code into another system. Generated glue code needs exact verification at both ends.
Check 05
Make the assistant prove a security fix
A proposed fix is only a hypothesis until a test demonstrates the previous bypass no longer works.
Check 06
Test the deployed version before release
Local success does not prove production configuration is correct. The deployed app has real cookies, origins, environment variables, and provider callbacks.
Ready for a second review?
Run a security scan before launch.
Use this checklist to guide your review, then scan the code for findings you may have missed. VibeCheck returns an ephemeral report with severity, exploit paths, and suggested fixes.