Is my Cursor app secure?

Cursor, Devin Desktop (formerly Windsurf), Claude Code and GitHub Copilot are AI tools that work inside your existing codebase. They write into whatever stack you already have rather than generating a fixed one of their own. That is the difference from Lovable, v0, Bolt and Firebase Studio, which each generate a stack of their own. The typical founder stack they build on is Next.js or React, with Supabase, Firebase or Postgres via Prisma or Drizzle. Login is usually Clerk or Auth.js, and payments run on Stripe. The problems that usually turn up are specific to that stack, not to the tool that wrote the code.

These are the things that usually turn up in apps built with an AI editor, in plain English. Each one points to where to go deeper, the launch checklist and the guides, rather than restating them.

• A logged-in user can open another user's data. A route that reads a record by its id without checking that the person asking owns it. Change the id in the URL and a stranger reads someone else's data. (IDOR, missing ownership checks) The launch checklist, check 02.
• A stranger can send a fake "payment succeeded". If the app trusts a payment webhook without verifying its signature, anyone can post the same message and get the access or the product for free. (Stripe webhook unverified) The launch checklist, check 05.
• The price is trusted from the browser. If the price of a purchase is read from the client, a customer can change it to zero, or to one cent, before it reaches you. (price trusted from the client) The launch checklist, check 05.
• A codebase the agent keeps re-reading. When the structure does not match the features, every change costs more, for a human or an AI, and the next fix is slower and riskier. (tangled codebase) The launch checklist, check 07.

These are a few of the common pitfalls, and there are many more. The full list is on the launch checklist.

Work through these on your own. They are free, and there is nothing to sign up for.

• The launch checklist. The questions to ask your AI before you launch, each with what a good answer looks like.
• Is my AI-built app safe to launch?. The three things AI-built apps keep shipping with.
• I built it with Lovable, Bolt or Cursor. Does that matter?. Why the tool does not matter, and what does.
• How much does my app cost to run?. The cost drivers and the exploits that ramp the bill.

The Quick Shakedown (from AUD 750) is the right fit for an app built with an AI editor. It covers the exact things these apps get wrong: exposed keys, open data, broken access, and the payment checks. If you want the whole app reviewed rather than just the highest-risk parts, the Full Shakedown (from AUD 1,500) goes through everything and hands back the engineer-ready clean-up, which is the same clean-up that makes it cheaper for your AI to keep working in the code. If you are prepping for a launch or a raise, Launch-ready (from AUD 2,500) adds the written brief your first hire, or your AI, can work from. Every price is "from", quoted up front for the size of your app and fixed once agreed.