You've built your app with Cursor. It works. Now audit it for security before real users touch it — here's the exact process, from headers to hardcoded secrets.
Anay Pandya
670 words
Anay Pandya
Founder of ZeriFlow · 10 years fullstack engineering · About the author
Key Takeaways
You built your app with Cursor. The features work. The UI looks good. You are ready to ship.
Before you do, spend 30 minutes on security. Not because Cursor writes bad code — it writes functional code. But functional and secure are two different things, and Cursor consistently optimizes for the first one. Here is the exact process to audit a Cursor-built app before real users touch it.
Is your site actually secure?
Run a free check — 60 seconds
Before opening a single file, deploy your app and run a free scan at zeriflow.com/free-scan.
The scan checks your deployed URL for: - Missing security headers (X-Frame-Options, CSP, HSTS, etc.) - TLS configuration issues - Exposed sensitive endpoints - Cookie security flags - CORS misconfigurations
Keep reading
Start with anything flagged as Critical or High. Note your score before fixing — you want at least 80/100 before launch.
Cursor default pattern when generating API routes is to write the happy path and skip authentication guards unless you explicitly asked for them.
Navigate to app/api/ (for Next.js App Router). Look for this pattern:
// Cursor-generated route — no auth check
export async function GET(request) {
const data = await prisma.user.findMany()
return Response.json(data)
}This route returns all users to anyone who calls it, authenticated or not. The correct pattern:
import { getServerSession } from 'next-auth'
import { authOptions } from '@/lib/auth'
export async function GET(request) {
const session = await getServerSession(authOptions)
if (!session) {
return Response.json({ error: 'Unauthorized' }, { status: 401 })
}
const data = await prisma.userProfile.findUnique({
where: { userId: session.user.id }
})
return Response.json(data)
}Go through every route in app/api/ and verify that routes handling sensitive data have this check at the top.
Cursor uses realistic-looking placeholder values when generating code. Run this from your project root:
git grep -iE "api[_-]?key|secret|password|token|private[_-]?key"Also check git history:
git log -p --all | grep -iE "api[_-]?key|secret=" | head -50If you find real credentials in git history, rotate them immediately — the credential is compromised from the moment it was committed.
The rule: Every secret goes in .env.local (development) or environment variables in your deployment platform (production).
Cursor does not generate security headers. Add this to next.config.js:
const securityHeaders = [
{ key: 'X-DNS-Prefetch-Control', value: 'on' },
{ key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains; preload' },
{ key: 'X-Frame-Options', value: 'SAMEORIGIN' },
{ key: 'X-Content-Type-Options', value: 'nosniff' },
{ key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
{ key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
]
module.exports = {
async headers() {
return [{ source: '/(.*)', headers: securityHeaders }]
},
}After adding headers, run the ZeriFlow scan again to confirm they are applied correctly.
Cursor frequently generates CORS with wildcard origins:
// Cursor-generated — WRONG for production
app.use(cors({ origin: '*' }))Fix it:
app.use(cors({
origin: process.env.ALLOWED_ORIGIN || 'https://yourdomain.com',
credentials: true,
methods: ['GET', 'POST', 'PUT', 'DELETE'],
allowedHeaders: ['Content-Type', 'Authorization'],
}))npm audit
npm audit fix --audit-level=highPay attention to Critical and High severity vulnerabilities. Update any package with known security issues before going to production.
next.config.jsnpm audit run and Critical/High vulnerabilities addressedRun the ZeriFlow scan at the start and again at the end to measure your improvement. A score above 80 means you have covered the major deployment-level security issues that automated scanning can detect.
Verify your AI-generated app is production-ready.
80+ security checks in 60 seconds — free, no account needed.
Related resources
Website Vulnerability Scanner
Run a broader website security audit across headers, TLS, DNS, cookies, SEO, and disclosure checks.
Security Headers Checker
Check CSP, HSTS, X-Frame-Options, and other response headers.
SSL Checker
Review TLS certificate, HTTPS, and transport security signals.
DMARC Checker
Validate email authentication records for domain spoofing protection.
CSP Checker
Review Content-Security-Policy coverage and common gaps.
May 10, 2026
How to Secure Your AI-Generated Next.js App (2026 Guide)
Monitor your security score
Schedule recurring scans and catch regressions after deployments.