Cursor
Scan the app Cursor deployed, not the editor
Cursor writes code on your machine. Visitors see whatever you deployed. Paste that public URL. The scan does not open the Cursor project or your local files.
A local .env that never got copied into the hosted site will not show up here. A /.env that the host answers with real assignment lines will.
What this scan actually checks
- The HTML of the URL you paste, including inline scripts.
- Up to 10 JavaScript files linked from that page, and only if they are on the same host.
- Response headers: Content-Security-Policy, Strict-Transport-Security on HTTPS, X-Content-Type-Options, X-Frame-Options or CSP frame-ancestors, Referrer-Policy, Permissions-Policy, and a CORS wildcard.
- Set-Cookie flags when a cookie is present: Secure, HttpOnly, and SameSite.
- A noindex robots meta tag or X-Robots-Tag, the page title, and the meta description.
- Whether /robots.txt and /sitemap.xml exist and are not the HTML app shell.
- Up to 25 same-origin links on the homepage, a few at a time.
- One request each for /.env, /.env.local, /.env.production, /.git/HEAD, and /.git/config.
- Secrets in the hosted HTML and same-origin bundles, including Stripe, OpenAI, Anthropic, AWS access key ids, GitHub, Slack, Supabase service_role, and private keys.
What it does not check
- It does not log in, try passwords, brute-force paths, or query a database.
- It does not read third-party scripts, your Git host, or the builder's project files. If a secret never shipped in the public response, this scan will not see it.
- Supabase Row Level Security and Firebase security rules are not checked. Those stay listed as coming soon until you can prove you own the domain.
- It does not review the git history on your laptop or secrets that exist only in a local env file.
What to do with the result
- Keep secret keys in the host's server environment. Client bundles, including anything compiled into JavaScript the browser downloads, are the wrong place for them.
- If the report shows a secret, the fix prompt names the kind of key and the file path we saw. The stored report keeps only a masked fragment, not the full value.
Questions
Can I paste a localhost URL?
The public scanner blocks private and loopback addresses. Scan the deployed https URL. Localhost is only available in a development fixture, not on the hosted site.
Does a good grade mean the app is secure?
No. It means this pass did not see the problems we check for in the public responses. It is not a penetration test.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.