Cursor · Security scan
Cursor is an AI-native code editor. It writes and edits code fast, but you're still the one wiring up hosting, environment variables, and deployment.
8 security checks run automatically: secrets, CORS, headers, dependencies, config exposure, auth flaws, debug artifacts, and deployment readiness.
What we look at for Cursor
Wardloom always runs the full catalogue — these are the ones Cursor projects most often get wrong, based on how the tool tends to generate and deploy code.
We review weak JWT secrets, missing rate limits, and insecure session patterns that show up in code and config.
Login is the front door. Soft session handling is how accounts get guessed, replayed, or shared without you noticing.
We check whether your cross-origin rules are wide open, especially wildcards paired with credentials.
Loose CORS lets other sites call your APIs as if they were yours. Tight origin policy keeps browser traffic on the paths you meant to allow.
We scan your dependency tree for known-vulnerable or abandoned packages that still ship with the app.
Most vibe-coded stacks inherit risk from npm. Known CVEs are public; attackers do not need inventiveness, only an unpatched install.
We check for debug flags, verbose errors, and source maps that still ship to production.
Debug leftovers hand attackers a map of your code. They also make your app look unfinished to careful users and reviewers.
Common Cursor mistakes
What a scan like this can't see
Wardloom is honest about its limits. Server-side authorization & auth logic is not something a read-only scan can verify from the outside — it requires a connected repo scan or a manual review. A clean result means nothing visible was wrong, not that everything was checked.
FAQ