Cursor Security Scanner
Is my Cursor app secure?
Cursor writes the code you asked for, and the protections it never mentioned - throttling on the login route, a CSRF token on the form, an ownership check inside the handler - are usually the ones missing, because nothing in the conversation ever raised them. This scanner takes your deployed URL and tests for those absent protections from the outside.
What we check on a Cursor-built app
Routes with no observable throttling
Sends repeated requests to sensitive-looking routes and reports when nothing slows, blocks, or challenges them.
Forms posting without a CSRF token
Inspects forms on your public pages for an anti-CSRF token and flags state-changing forms that post without one.
Access control on API routes
Probes JSON, debug, and admin-looking paths with no session to see which return data anyway, and which HTTP methods they accept.
Read more →Secrets in the shipped bundle
Matches your deployed JavaScript against key patterns for 30+ providers, plus generic secret-shaped assignments.
Read more →Tokens in browser storage
Flags JWTs, passwords, and secrets written to localStorage or sessionStorage, and cookies missing HttpOnly, Secure, or a strict SameSite.
Read more →Vulnerable dependency versions
Reads the library versions your frontend advertises and flags releases with known published vulnerabilities.
Read more →How the Cursor Security Scanner works
- Step 1
Paste your deployed app URL
Your live URL only. No repository access, no Cursor workspace, no CI integration, no environment variables, and no Ubserve account.
- Step 2
We test the running app, not the code
We fetch the page, download the JavaScript it serves and scan it for provider keys and stored tokens, inspect forms for CSRF tokens, send repeated and unauthenticated requests at sensitive routes to see what is throttled and what answers, and check dependency versions, headers, cookies, CORS, and TLS.
- Step 3
You get the report, partially unlocked
You see the issue count, a letter grade, and up to two findings in full, free. The rest - including the highest-severity findings and the copy-paste fix prompts - unlocks with a one-time report unlock or a plan.
Frequently asked questions
How do I know if the code Cursor wrote is missing security controls?
Test the deployed app rather than reading the diff. Hit your login or signup endpoint twenty times in a row and see whether anything slows you down - if not, nothing is throttling it. Call an API route in a private window with no session and see whether it returns data. Submit a state-changing form without the token your app issued. Absent controls are invisible in a code review because there is nothing to look at; they only show up when you send the request that should have been refused.
Why does an AI coding assistant leave these out?
Because it answers the question it was asked. A prompt like 'add a login endpoint' has a complete, correct answer that contains no rate limiting, because rate limiting was not part of the request and the endpoint works without it. The same holds for CSRF tokens, ownership checks, and audit logging: each is an extra constraint someone has to think to ask for. The model is not wrong, it is scoped - and the practical rule is that if the assistant never mentioned a protection, your code most likely does not have it.
How does the scanner work?
It runs the standard Ubserve public scan against your deployed URL. We fetch the page, download and scan the JavaScript bundles for provider keys and browser-stored tokens, read your forms for CSRF tokens, send repeated requests at sensitive routes to detect the absence of throttling, probe API and debug paths unauthenticated, and check dependency versions, security headers, cookies, CORS, and TLS. All of it is done from outside, against your public URLs.
Is it free? Do I need to sign in?
The scan is free and you do not need an account to run it. You get the issue count, a letter grade, and up to two findings shown in full - location, evidence, and severity - at no cost. The rest of the report stays locked, including the highest-severity findings and the copy-paste fix prompts you can hand to your AI coding tool. Unlocking everything is a one-time payment for that report, or a plan if you want repeat scans and monitoring.
Does Ubserve see my source code or my Cursor workspace?
No. This scan only reads what your app already serves to the public: the HTML at your URL, the JavaScript bundles that page links to, HTTP response headers, TLS certificate details, and public DNS records. We never ask for a repository, a database password, a service-role key, or an app login, and we cannot see private source code or authenticated pages. When we find a secret in your bundle, we found it because your browser downloads it too - anyone viewing your site can read the same bytes.
Will scanning break my app or lock me out of my account?
No. The repeated requests used to detect missing throttling are ordinary reads, not login attempts with credentials, so nothing locks an account. We never insert, update, or delete data and we never create a user. Probes are paced a couple at a time with pauses between them rather than fired in a burst.
What founders say
5.0 out of 5 - Ubserve, from 3 reviews
“Helped me find a critical database issue that would've done real damage. I recommend it for every founder.”
“Caught a critical CSP issue on my frontend within minutes. Don't ship without a scan.”
“The free scan took under 60 seconds to find real issues in my project.”
Other free tools
See all tools →
AI BuildersWindsurf Security Scanner
Checks a Windsurf-built app for the controls the agent never raised: throttling, CSRF tokens, and unguarded endpoints.
Open tool →
AI Buildersv0 Security Scanner
Checks a deployed v0 app for secrets in serialized props, route handlers that answer anyone, and dev surfaces left on.
Open tool →Website Vulnerability Scanner
The full public scan: bundles, headers, TLS, CORS, endpoints, DNS, and database exposure in a single pass.
Open tool →Keep reading
- Is Cursor safe?Where Cursor-built apps break, and the checks that catch it before launch.
- Pre-deploy security checklist for vibe-coded appsThe last pass before you ship.
- Why AI security prompts gave me false confidenceAsking the model whether it is secure is not a test.
- Broken access control in AI-built appsThe check that gets skipped most often.
- Windsurf vs Cursor: security comparedHow the two assistants differ in what they leave out.
Run the Cursor Security Scanner
Paste your URL and see what your app is handing to the public. Free, no account, no repo access.