Security for apps built with Cursor

Cursor writes code fast but doesn't police your .gitignore. The most common problem is an uncommitted ignore list that ships .env with your keys, internal rules (.cursorrules) and history (.specstory/) straight to production.

A scan from your public URL finds them and offers a Cursor-specific fix: add .env*, .cursorrules and .specstory/ to .gitignore and your build ignore, move keys to .env.local plus your host's env vars, and route AI calls through your own backend. You can run the scan from inside Cursor via the MCP server.