GuardCue

Is my Cursor app safe to launch?

Paste your address. We check your live Cursor app the way a stranger would, then tell you in plain English what could cost you money, and how to fix it.

Free. No sign-up. We check the one page you give us, and only what any visitor can already see.

Could end your business

Your app takes a visitor at their word about who they are.

what we didread the code where your app decides whose data to send back
what it showedno check that the person asking owns what they asked for
What it means for youSomeone asks for customer 124's details and is handed them, because nothing ever checked they were customer 124. Every record becomes reachable one number at a time.
This is how every finding is written. No jargon, ever.
About Cursor

Working is not the same as safe.

Cursor is an AI code editor, used both by people who write code and by founders following along with what the AI suggests. It writes real code into a real project, so how safe your app is comes down entirely to that code.

Where your data livesA Cursor project can use any database. Where it is Supabase the read-rule question applies; everywhere else your own code decides who may read what. Both are checked.

Tools like this one write ordinary code, so a finished app carries no sign of which editor built it. That changes nothing about the check: we look at what your app actually does, not at what wrote it.

What we find

The faults we find in Cursor apps.

Written the way your own report would write them. These live in the app Cursor built for you, not in Cursor’s own service, which is why only a check of your app answers it.

Could end your business

Anyone on the internet can read your customer list.

What it means for youNo login, no password, no attacker needed. Someone who finds the address copies the whole table. This is the kind of leak you may have to tell every customer about.
what we didasked your site for its customer list, without signing in
what it showedthe whole table, with names, emails and phone numbers
Could end your business

Your master key is in the code every visitor downloads.

What it means for youThat key ignores every rule you set about who may see what. Anyone who looks can read, change or delete everything you hold, including every customer record.
what we didread the code your site hands to every browser
what it showeda master key, in a file any visitor can open
The honest part

What this check cannot see.

Every scanner looks cleaner if it stays quiet about what it missed. We would rather tell you.

Could not check

Reading the code itself needs you to connect the project. Without that we check everything a visitor could reach and name every question we left open, rather than implying it is fine.

If the answer is yes

You found something. Now what?

You are already in an editor, which makes this the easiest case to fix: you can see the code and the changes are small. Rules on the tables, keys moved to the server, a limit on anything charged per use.

The free check works from your live address, so it finds what is exposed rather than what is written. Paying gets you the exact wording to hand to Cursor for each fault, and a re-check afterwards.

What a plan adds →

Once you know what is wrong

Fix it inside Cursor, without copying anything.

Connect us to Cursor once, and you never move between two windows again. You say “check my app and fix what you find” in Cursor itself, and it asks us directly: what is wrong, the exact wording to fix it, then a second check to prove it worked.

It reads, it does not write. We never touch your app ourselves. Cursor makes the change, with you watching.

How to connect it to Cursor, about two minutes →

Before you paste your address

Questions from people who built with Cursor.

I wrote this in Cursor. Can you even tell it was built with AI?
No, and we do not try. An editor writes ordinary code and leaves no fingerprint, unlike a hosted builder. That changes nothing about the check: we look at what your live app does, which is the same question whoever or whatever wrote it.
The AI wrote most of it and I reviewed it. Is that enough?
Review catches what you are looking for. The faults we find most are the ones nobody looks for, because nothing is wrong on the screen: a table that works perfectly and happens to be readable by anyone. Reading the code is how you find bugs; opening the app from outside is how you find exposure.
My project is private on GitHub. Does anything leak from that?
Not from the repository itself while it stays private. What leaks is what your running app sends to a browser, and that is public by definition. A key in the page is exposed whether or not the code it came from is.
Check one thing at a time

Free checks for a Cursor app.

Is a secret key sitting in my website?Check for exposed keys →Is my database readable by anyone?Check my database →Can one customer see another customer’s data?Check who can see what →

Where these facts come from

Is my Cursor app safe to launch? · GuardCue