ShipPatrolScan your site for legal, security and SEO gaps, then fix them
Built with Cursor

What Cursor doesn't set up for you

Cursor is an AI editor and coding agent, not a host. It writes what you ask for and hands the result to whatever framework and hosting you picked, so there are no platform defaults to lean on. Freeing, yes. It also means every item on this list is yours.

What Cursor gives you

What it is
Cursor describes itself as an AI editor and coding agent. It connects to code hosts and tools such as GitHub, GitLab and Linear; its docs do not describe hosting or deploying your app. Source: cursor.com (opens in a new tab)
Stack, database and hosting
Whatever you choose. The checks that matter depend on the framework and host, so this list covers the common ground.

What Cursor already checks

The checklist

What's still on you

  1. Keys in the browser bundle

    Every frontend framework has a way to put values into the JavaScript visitors download: VITE_, NEXT_PUBLIC_ and friends. An agent wiring up an API in a hurry can reach for one when the key should stay on a server. Code review helps; checking the published bundle is the final word.

    Patch checks:Critical Secret API key in your JavaScript

  2. Database rules that let anyone in

    If the app talks to Supabase or Firebase from the browser, their access rules are what protect the data. Supabase says to enable row-level security on every table; Firebase warns that test-mode rules let anyone read and write. Code review sees the rules in your repo, not necessarily the ones live in the console.

    Patch checks:Critical Supabase tables readable with the public keyCritical Firebase data readable without signing in

  3. Files that came along to the server

    If you deploy by copying a folder to a server, a .env file or the .git directory can be uploaded with it. Anyone who guesses the path can then download them. ShipPatrol only checks for these after you verify you own the site.

    Patch checks:Critical Configuration files can be downloaded

  4. Security headers

    Headers such as Content-Security-Policy, HSTS, framing rules and nosniff come from your host or your server code. What gets added by default varies by host. Check what your live site sends rather than what the config file says.

    Patch checks:Medium No Content-Security-Policy header

  5. Analytics and pixels that load before consent

    An agent asked to add analytics will add analytics. Making it wait for consent, and building a banner with a real Reject option, is a separate request. In the UK and EU, non-essential cookies need consent first.

    Patch checks:Critical Trackers load before consentHigh No cookie banner

  6. A privacy policy that matches what the site does

    Your privacy policy should name the services the site uses: hosting, database, payments, email, analytics. Each integration added in the editor is another line it may need.

    Patch checks:Critical No privacy policyMedium Privacy policy doesn't mention services the site uses

  7. Pages search engines and link previews can read

    If you built a single-page app, crawlers and link previews may see an almost empty page until JavaScript runs. Either way, each page needs its own title, description and Open Graph tags, plus a sitemap and robots.txt.

    Patch checks:High Pages are blank without JavaScriptMedium Pages with missing or duplicate titlesMedium No sitemap.xml

  8. Alt text, contrast and form labels

    Images need alt text, text needs enough contrast against its background, and form fields need labels a screen reader can announce. These are quick to fix and easy to forget.

    Patch checks:Medium Images without alt textMedium Text contrast too lowMedium Form fields without labels

What ShipPatrol adds

  • Checks the deployed site, not the repo, from the UK, EU and US, with the cookie banner accepted and rejected.
  • Compares your privacy policy with the services the site actually loads.
  • Re-scans daily or from a deploy hook and emails you about new issues.
  • Paid reports include fix prompts written for pasting into Cursor.

ShipPatrol isn't affiliated with Cursor. Product names belong to their owners. Facts about Cursor were checked against its own documentation on 21 October 2026 and may have changed since. Not legal advice.

Free scan

Scan your Cursor site.

Paste the published address. Patch visits from the UK, the EU and the US and tells you what he finds. Free, no signup.

No signup needed. Not legal advice; every check names its source.

Sources