Reeve Is your Cursor app safe?
Cursor lets you build real software by describing what you want, with the AI writing much of the code. That's powerful — but it also means code can ship that you never read closely, and a stray key or setting can go out with it.
Reeve checks the most common problems from the outside, for free, and explains anything it finds in plain English. No install, no access to your accounts — only what's already public.
Paste your app's link. About 20 seconds. See your grade with no signup.
What can actually go wrong with a Cursor-built app
None of these mean you did something wrong — they're the normal side-effects of letting AI write code fast. Here's what's worth checking:
A secret key written straight into the code
When the AI wires up a service, it sometimes puts the key right in the code to make things work — and if that code runs in the browser, anyone can read it. Some keys are meant to be public and that's fine; Reeve reads your app's loaded code, finds any keys, and tells you which are safe and which need to move to the server.
A committed .env or exposed .git folder
Keys are supposed to live in a .env file that never ships. But it's easy to accidentally commit .env — or deploy the hidden .git folder — so the whole history, keys included, becomes downloadable. Reeve checks whether either is reachable from the outside.
Your database left open (RLS off)
If your app stores data — often in Supabase or another Postgres — there's a rule (Row Level Security) for who can read or change each row. If it's off, your tables can be open to anyone who finds the address. It's the most common serious issue, and it's invisible unless you check.
Public file storage
If your app accepts uploads, they live in storage "buckets." A public bucket means anyone can list or download what's inside, so a private file can end up visible to everyone. Reeve checks whether your buckets are listable; it never downloads anyone's files.
Source maps left on
A "source map" reveals your app's original code to anyone who looks. Useful while building, but in production it gives strangers a readable copy of how your app works and makes other gaps easier to find. Worth tidying. Reeve checks whether yours are exposed.
Missing safety headers & open endpoints
Small settings that tell browsers how to protect your visitors, plus whether your data endpoints answer to anyone or any website. Minor alone; together they add up. Reeve flags what's missing.
What Reeve is — and isn't
Reeve is a free, read-only check from the outside — like an inspector trying the doors without going in. It's fast and catches the common, high-impact mistakes. It is not a full security audit, and a clean grade isn't a guarantee — it means the obvious doors are shut.
Cursor is an editor, not a host, so it doesn't deploy or guard your app for you — more of that is on you and whatever code the AI produced. Cursor's own tools can help review code as you go, and if you use Supabase its advisor flags database issues. What Reeve adds: an outside view of the app you actually shipped, in plain words you can act on. And if you'd rather not think about it, we can watch it for you.
Want it handled, not just checked?
Reeve Care keeps watching your app, backs up your data, and helps you fix things when they break — so you can keep building instead of worrying.
Learn about Reeve CareQuestions, answered honestly
Is code written by Cursor's AI secure?
It can be good code, but "written by AI" doesn't mean "checked for safety." The AI optimises for making things work, which sometimes means a key in the wrong place or a missing database rule. The only way to know is to check what's exposed — Reeve does that free in about 20 seconds.
I think I committed a .env file — is that dangerous?
It can be, if the file (or the hidden .git folder) is reachable on your deployed site, because it may contain live keys. Reeve checks from the outside whether either is downloadable, so you know whether to rotate those keys.
How do I know if my Cursor app is leaking API keys?
The usual cause is a key written directly into code that runs in the browser. Reeve reads your app's loaded code, finds any keys, and tells you which are safe to be public and which need to move to the server — without storing the real values.
Will scanning my app change anything?
No. Reeve only looks at what's already public from the outside. It never logs in, never changes anything, and never downloads your files — read-only, like checking whether a door is locked without stepping inside.
Built somewhere else? We've got the same honest rundown for:
Automated external check, not a full audit. Absence of findings is not a guarantee of safety.