Is my Cursor app safe to launch?

What Cursor already does for you

• Cursor's .cursorignore file keeps files like .env out of the Agent's context. Cursor's docs say it is not a security boundary: terminal commands and MCP tools can still read those files.
• Bugbot, Cursor's pull-request reviewer, looks for bugs and security issues in code changes if you use it.
• Your host decides the rest. In Next.js, anything in an environment variable starting with NEXT_PUBLIC_ is copied into the page. In Vite, the same goes for VITE_.

Code review looks at what you wrote. Throttle Bird looks at what actually got published: the page and JavaScript a visitor downloads, your security headers, HTTPS, and whether your database answers a stranger.

6 checks before you share the link

1. 1. Your .env file is not on GitHub

   Why it matters: If .env was ever committed, every key in it is readable by anyone who can see the repo, and stays in its history.

   How to check: Open your repository on GitHub and look for .env. Check that .gitignore lists .env and .env.*.

   Fix prompt to paste into Cursor

   Copy prompt

   Make sure .env and .env.* are in .gitignore and are not tracked by git. If a .env file was ever committed, tell me which keys were in it so I can rotate them, and remove it from tracking.

2. 2. No secret behind a public prefix

   Why it matters: NEXT_PUBLIC_ and VITE_ variables are written into your JavaScript at build time. Anyone can read them in their browser.

   How to check: Search your project for NEXT_PUBLIC_ and VITE_. Each one should be something you'd be fine posting publicly.

   Fix prompt to paste into Cursor

   Copy prompt

   List every environment variable that starts with NEXT_PUBLIC_ or VITE_. For any that holds a secret (OpenAI, Stripe secret key, database password, service_role key), move it to a server-only variable and call that service from a server route instead.

3. 3. API routes check who's calling

   Why it matters: An API route with no login check lets anyone use it, including to read other users' data or run up your AI bill.

   How to check: For each route in your api folder, ask: what happens if a logged-out stranger calls this?

   Fix prompt to paste into Cursor

   Copy prompt

   Go through every API route. Each one that reads or changes user data must check the logged-in user on the server and only return that user's data. Add a basic rate limit to routes that call paid services like OpenAI or send email.

4. 4. Database rules are on

   Why it matters: If your app talks to Supabase or Firebase from the browser, the database rules are the only thing standing between a stranger and your data.

   How to check: Supabase: check that row-level security is on for every table. Firebase: check that your rules don't allow reads or writes for everyone.

   Fix prompt to paste into Cursor

   Copy prompt

   Check my database access rules. For Supabase, enable row-level security on every table with policies limited to the row owner. For Firebase, replace any rule that allows read or write for everyone with rules that require the signed-in user to own the data.

5. 5. Security headers are set on your host

   Why it matters: Headers like Content-Security-Policy and Strict-Transport-Security block common browser attacks. Most hosts don't add them for you.

   How to check: Run the free scan, or check your host's headers config (next.config, vercel.json, or a Netlify _headers file).

   Fix prompt to paste into Cursor

   Copy prompt

   Add these response headers to every page: Content-Security-Policy (with frame-ancestors 'none'), Strict-Transport-Security, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and Permissions-Policy. Use my host's config file.

6. 6. Titles, previews, and a sitemap

   Why it matters: So people can find you and your link looks good when shared.

   How to check: Text your link to yourself. Visit /robots.txt and /sitemap.xml on your live site.

   Fix prompt to paste into Cursor

   Copy prompt

   Add a unique title and meta description to every page, Open Graph tags with a 1200x630 image, a canonical URL, a robots.txt, and a sitemap.xml.

What the free scan checks on your live Cursor app

• Secret keys sitting in your page or its JavaScript files (Stripe, OpenAI, Anthropic, Supabase secret and service_role keys, GitHub, AWS, Google, private keys).
• If your page already exposes its Supabase or Firebase settings, one read-only test with the public key to see if a stranger can read your tables. Rows are never stored.
• Missing security headers that block injected scripts and click-jacking.
• A rate-limit hint on up to two /api/ routes found in your code (one normal request each, not a load test).
• HTTPS, certificate expiry, and whether plain http:// redirects to https://.
• Page title, description, link-preview tags, robots.txt and sitemap.
• How fast the page loads, page size, and JavaScript files that fail to load.

The scan only reads your public site. It never logs in, submits forms, or changes anything. It can't see inside your Cursor project, so it doesn't replace testing sign-up and payments yourself.

Scan my Cursor app free

Questions

Does Throttle Bird read my code or my repo?

No. It only reads your public website, the same files any visitor's browser downloads.

My app runs on localhost. Can I scan it?

Not yet. Deploy it to a public preview URL first, then paste that link.

Can I paste the fix prompts into Cursor?

Yes. Every finding comes with a prompt written for Cursor or any coding tool.