Cursor security checklist

Pre-launch security checklist for apps built with Cursor: secrets, auth, database rules, and headers.

Cursor will happily paste secrets into client components if you ask it to 'just make it work.' Keep a project rule that forbids secrets in the frontend.

Checklist before you share the URL

• [ ] No service_role, sk_live_, sk- (OpenAI), or AWS keys in client bundles
• [ ] Paid API calls go through a server/edge function
• [ ] Every Supabase table has RLS on with real policies (not true)
• [ ] Firebase rules require auth != null where data is private
• [ ] /.env and /.git/HEAD return 404 on production
• [ ] Auth guards on every API route that reads or writes user data
• [ ] Basic headers: HTTPS, HSTS, X-Content-Type-Options: nosniff, a CSP you understand
• [ ] Re-scanned after the last big AI change

Review this Cursor app for production security. Move all secret API keys to server-side functions. Enable Supabase RLS (or tighten Firebase rules). Block .env and .git on the host. Add auth checks on API routes. Summarize every change you make.

Related: Hide API keys · Fix it and prove it

More guides

• Is my Lovable app secure?
• How to enable Supabase Row Level Security (RLS)
• Exposed Supabase service_role key: what to do now
• Lovable security checklist