SniffPupCursor app security scan for your live site
Built your app with Cursor and deployed it? Paste the live URL below. SniffPup checks what your deployed site shows to anyone who visits it, passively and read-only.
This runs SniffPup's normal free scan, so you get the whole report, not just this one check. Results cover your whole deployed site: secret keys, public files, source maps, Supabase key exposure and security headers. The free report lists every issue it finds with its severity, plus the full fix free for every critical issue (with no critical, one other fix). Only scan sites you own or are authorized to test. What the scanner does and never does.
Start with Cursor's own safeguards
Cursor does a lot to help here. It ignores .env* files and everything in your .gitignore by default, and a .cursorignore file can block more paths from Agent, Tab, Inline Edit and @ mentions. Its ignore-file docs are candid that the terminal and MCP tools the Agent uses can't be blocked this way, and that complete protection isn't guaranteed. Bugbot reviews pull requests for bugs and security issues. Use both.
Those work on your code before it ships. This scan adds a different view: the live site after it's deployed, from the outside, the way a stranger's browser sees it.
What this checks
- Secret keys in your shipped JavaScript, including anything that slipped into a
NEXT_PUBLIC_orVITE_variable, and Supabaseservice_roleorsb_secret_keys. Any key found is masked in the report. - Public files such as
/.env(variable names only, never values),/.git/configand public source maps. - Supabase in the browser: whether your site talks to Supabase and whether the public anon key is present (normal, shown as information).
- Security headers, cookie flags and HTTPS on the page you enter, plus whether your HTTPS certificate is valid and when it expires.
- Outdated JavaScript libraries with known vulnerabilities (the free scan shows the worst one in full).
What it can't tell you
- It can't see your code, your repo or your Row Level Security policies. Code review and the Supabase RLS checker guide cover those.
- It doesn't log in, so pages behind sign-in aren't checked.
- It scans live web URLs only, not native mobile apps.
- A 100 score means no issues were found in our checks. It is never proof of security.
A simple routine
- Keep secrets out of the repo and out of
NEXT_PUBLIC_andVITE_variables. - Review the diff (or let Bugbot) for anything touching sign-in, payments or data access.
- Deploy, then scan the live URL here.
- Fix anything new, then scan again.
The free scan lists every issue by title and severity and gives the full fix for every critical issue free (with no critical, one other fix is free). The one-time $9 Full Fix Report unlocks every fix plus 30 days of re-scans. See pricing.
More: Is my Cursor app secure? A pre-launch checklist and the best free security scanners for vibe-coded apps.
Questions
How do I run a Cursor app security scan?
Deploy your app, then paste its live URL into the box on this page. SniffPup checks what the deployed site serves to any visitor: secret keys in your JavaScript, public .env and .git files, source maps, Supabase key exposure, headers, cookies and HTTPS.
Cursor already reviews my code. Why scan the live site too?
Cursor's Bugbot reviews code changes in pull requests, which sees things no outside scan can. A live-site scan adds the other side: what your build actually ships, such as a NEXT_PUBLIC_ or VITE_ variable that ended up in the browser or a file left in the web root.
Does SniffPup need my repo or Cursor project?
No. You only enter your live URL. SniffPup never logs in, never sees your code and never uses a secret key it finds.
Does a 100 score mean my Cursor app is secure?
No. A 100 means no issues were found in our checks. It is never proof of security, and the free scan can't see your code, your database policies or anything behind a login.
Can it scan a native mobile app?
No. SniffPup scans live web URLs only, not native iOS or Android apps.