Security Review Checklist for Cursor-Generated Code
Updated 2026-10-17
AI-written code tends to be plausible and functional, and to skip the boring parts: authorization checks, input limits, and error handling that does not leak internals.
Review every route
- Who can call this? Is the session checked?
- Can user A pass user B's id and get their data?
- Is input validated and size-limited?
- Do errors leak stack traces or SQL?
Dependencies
Check that suggested packages exist and are the intended ones (typosquats are a real supply-chain risk), pin versions with a lockfile, and run npm audit before launch.
Checklist
- Auth on every mutating route
- Object-level authorization
- Input validation (e.g. zod)
- No secrets in client
- Lockfile committed
- Dependencies verified
Copy-paste fix prompt
Go through every API route and server action in this project. For each, tell me who can call it, whether it checks the session, whether it verifies the caller owns the requested resource, and whether input is validated. Fix any gaps.FAQ
Can I ask the AI to review its own code?
Yes, it helps — especially with a specific checklist — but verify fixes with tests and manual checks.
What's the most common gap?
Missing object-level authorization: routes check that a user is logged in, but not that they own the record.
Check your deployed app in ~25 seconds
Free passive scan: leaked keys, Supabase exposure, public config files and headers.
Run a free scan