Security check for apps built with Cursor
Cursor fixed the error. Check what it opened.
Any stack, any host. Paste the URL of your deployed app: we check what is visible from outside and give you a prompt to paste into Cursor’s agent for each issue.
First scan is free, no signup and no code access. By scanning you confirm you own this site or are authorized to test it, and agree to the Terms and Privacy Policy.
One key needs rotating before launch.
Built with Cursor · Next.js · Supabase
- Issues
- 5
- Hardening
- 7
- Checks
- 108
- CriticalSupabase service key is readable in main.jsJS bundle
- HighSource map publishes your src/ folderSource maps
- MediumAnyone can send email as your domainDMARC
- MediumSession cookie set without SecureCookies
- LowNo Content-Security-Policy headerHeaders
Passive external check; application logic (SQLi, IDOR) is not tested.
- checks across headers, TLS, DNS, email and supply chain
- 100+
- secret patterns searched in your JavaScript and source maps
- ~40
- for the first scan, no signup and no code access
- $0
The diff was too long to read every line.
Faster than you review
Long agent sessions produce changes faster than anyone reads them. The agent optimises for making the error go away.
A key in the browser fixes it
Missing key on the client? The agent will happily expose it there. Denied query? It may relax the rule that denied it.
The .env came along
A committed
.envfile ends up on the server, and a static handler pointed at the wrong folder makes it downloadable.
Demo replay
What runs while you wait a minute.
A demo of a scan on an app built with Cursor. We look at the deployed site, not your repository, so it catches what the agent shipped.
- passnothing visible from outside
- warnworth fixing
- faila finding with a fix prompt
- passstackNext.js on Vercel detected
- passtlsCertificate valid, modern TLS only
- warnheadersSession cookie without Secure flag
- failmaps/assets/index-a1b2c3.js.map is public
- warnemailSPF record found, no DMARC
- failfiles/.env answers 200after verify
What we check on a Cursor-built app
Problems that follow AI-written code on any stack. Public checks run on every scan; Verified ones after you prove the domain is yours.
Keys behind client prefixes
VITE_, NEXT_PUBLIC_, REACT_APP_ all mean “public”. We search your bundle for about 40 key patterns
Public
Source maps in production
Maps linked from your scripts that publish your original source, and any keys inside them
Public
Supabase or Firebase open to anyone
Whether the Supabase tables your app references, or your Firebase Realtime Database, answer without login. Rows are never stored
After you verify
Files that should never be public
.env files, .git, SQL dumps and config files your server answers for
After you verify
How it works
From URL to fixed in four steps.
Paste your URL
No code, no login, no setup. The first scan takes about a minute.
Read what a stranger could do
Each issue is explained by its consequence, in plain English, ranked by severity.
Fix with Cursor
Copy the fix prompt for the issue and paste it into Cursor.
Rescan and confirm
Verify your domain for free to unlock the deeper checks, then rescan to see the issue gone.
Free first scan. No signup, no code access.
What a scan looks at
- secretsAPI keys in your JavaScript
- secretsPublished source maps
- headersContent-Security-Policy
- headersCookie flags
- headersCORS rules
- tlsCertificate and TLS versions
- webMixed content
- emailSPF record
- emailDMARC and DKIM
- dnsDNS records
- dnsDNSSEC
- recordsCertificate transparency
- supply chainOutdated JS libraries
- supply chainScripts without integrity
- recordsWeb archive history
Inside the report
A finding, and the prompt for Cursor’s agent.
Every issue comes with a prompt that names the file, the problem and what done means. Paste it into Cursor, review the diff, deploy, rescan.
Cursor security guideHigh
Source maps publish your code and a key
Anyone can download your original source from the maps, and one of them contains an API key.
Found at /assets/index-a1b2c3.js.map
Production serves JavaScript source maps from /assets/*.js.map. In vite.config.ts set build.sourcemap to false for production builds and make sure no .map file is deployed. Then search src/ for any secret that was visible in those maps and tell me which ones I need to rotate.
Compared
Not instead of your other checks. Next to them.
| What | Shypset | Reading the code yourself | Manual pentest |
|---|---|---|---|
| Where it looks | Your live site, from outside | Your repository | Your app, by a security tester |
| Headers, TLS, DNS, email | Checked on every scan | Only if you know to look | Usually covered |
| What actually got deployed | The running site | Only the source | The running app |
| Logged-in logic (IDOR, per-user rules) | Not tested | If you read for it | Yes |
| Cost and time | First scan free, about a minute | Hours of your own time | Quoted per project, days to weeks |
Not a pentest replacement before a big deal. A minute-long check of what is visible from outside, before you launch.
Before / after
A file that should never be public, before and after.
An agent that moves files around can put a .env where the web server serves it. After you verify the domain, we ask for the usual suspects: .env, .git, backups.
CriticalYour .env file is downloadableVerified check
public/ favicon.ico .envsrc/ main.ts
Critical: GET /.env returns your keys.
The deployed site serves /.env. Move .env out of public/ to the project root, add it to .gitignore, make sure the build never copies it into the output, and redeploy. List every key in that file so I can rotate them, because they were public.
An example. Each finding in the report comes with a prompt like this.
Pricing
Your first scan is free, no signup needed. Upgrade when you want the full report and fix prompts for every issue.
Free
For your first check before launch
$0/ month
- 3 scans per month
- 1 free rescan of each scan within 7 days
- Fix prompt for your top issue
- Security grade and severity breakdown
- OWASP Top 10 and CWE mapping
- 7-day history
Pro
For founders shipping AI-built apps
$15/ month
Billed monthly, $180 a year
- Up to 200 scans a month (fair use)
- 1-year history
- Full report for every issue
- Fix prompts for Cursor, Lovable, Claude and more
- HTML and Markdown export
- “Scanned by Shypset” badge for your verified domain
- Weekly monitoring with email alerts (verified domains)
Agency
For agencies and freelancers. Coming soon
Soon
- More domains for client projects
- Reports you can hand to clients
- Need more today? Contact us
Launch Pass
$9 one-time
One domain for 30 days: the full report and every fix prompt, plus 3 rescans. The public report and badge are not included.
Questions
No. We check the running site by URL and never see your code. Deploy to a preview or staging URL if you want to scan before launch.
Yes. They are plain instructions tied to the finding, written to be pasted into an AI coding agent.
The first scan is free, with no signup and no code access. A free account gives you 3 scans a month. The full report and a fix prompt for every issue come with Pro or a one-time $9 Launch Pass.
Without verification we only read what any visitor’s browser can, plus public records such as DNS. Deeper checks, like asking your database tables for a row, run only after you verify that the domain is yours. Verification is free.
No. It is a passive external check: it does not log in and does not test application logic such as SQL injection or IDOR. A clean report means nothing is visible from outside.
Your agent wrote the code.
We check what it left open.
Paste a URL and get the report in about a minute. First scan is free, no signup and no code access.
Ask the team behind the scanner.
Real people read every message. Tell us what you need and we will answer by email.
- Questions
- About a scan, a finding, or how a check works.
- Agency and team needs
- More domains, reports for clients, invoicing.
- Security concerns
- A vulnerability in Shypset, or a request not to scan your domain.
Prefer email? Write to info@softdoes.com.