Security for apps vibe coded with Cursor
An app you vibe coded with Cursor can be safe, but you have to check it. The AI writes what you ask for and can miss login checks, leave keys in the wrong place, or trust user input. Review auth, keys, database rules and packages before launch.
Step-by-step checklist
- Ask: where does each secret key live? It should only be read on the server.
- Check your
.gitignorecovers.envfiles, and that none were committed. - For every API route, confirm it checks the user and their rights before it reads or writes data.
- If you use Supabase, turn on RLS for every table and review the policies.
- Look for raw SQL built from user input. Use query parameters instead.
- Run
npm audit(or your package manager's audit) and update risky packages. - Check that every package the AI added is real and well known. Typos in names can pull in bad packages.
- Ask Cursor to review the code for security issues, then check its answer yourself. Do not trust it blindly.
FAQ
Is code from Cursor less safe than code I write?
Not always. But it is easy to accept a lot of code fast without reading it. That is where holes slip in.
Can I just ask the AI to make it secure?
It can help find issues. It can also miss them or say things are fine when they are not. Test the real app.
What is the most common problem?
Common ones are API routes with no auth check, secret keys in browser code, and open database tables.
How can DeployVet help?
The Free check ($0) scans your live site. The Scan ($7) adds a read-only look at your repo. Pro ($15/mo) runs weekly.
Is DeployVet a penetration test?
No. It finds common, known issues. For apps with very private data, also get a pro review.
Check your app for free
DeployVet scans your live site from the outside, like a stranger would. You get a score and the worst issue with a fix.
DeployVet has three plans. The Free check is $0. A one-time Scan is $7. Pro is $15/mo and adds weekly scans and email alerts. For paid plans you pay first, then the scan runs.