Cursor wrote the code. Who checked production?
Agents are good at making things work and bad at noticing what they exposed: an environment variable prefixed for the client, a .env file served as a static asset, a header nobody added. Check the live site and hand the list back to your agent.
Free, no sign-up. The basic check makes only the requests an ordinary browser would.
What we check on a site built with Cursor
- CriticalFree check
Server secrets that ended up in the client bundle
A secret put in a NEXT_PUBLIC_ or VITE_ variable is compiled into JavaScript every visitor downloads. We look for Stripe, OpenAI, Anthropic, AWS, GitHub and other key formats.
- CriticalPro
.env or .git reachable over HTTP
After you verify the domain we request a handful of well-known paths like /.env and /.git/config — the files that hand out every password at once.
- MediumFree check
Weak or missing Content-Security-Policy
No policy, or one with unsafe-inline that doesn’t stop much. We say which directive weakens it.
- LowFree check
Server version disclosed in headers
Headers that tell attackers exactly which framework and version to look up.
Or let Cursor run the check itself
Connect ScanYourSite as an MCP server and ask your agent to scan the site and fix what it finds. Or copy the prompt from any report into the chat.
Fix these issues on app.example.com. 1. A Stripe secret key (sk_live_…9Kq) is in _next/static/chunks/app-4e2.js. It comes from NEXT_PUBLIC_STRIPE_KEY. Roll the key in Stripe, rename the variable without the NEXT_PUBLIC_ prefix and use it only in a route handler. 2. Content-Security-Policy allows 'unsafe-inline' for scripts. Use a nonce in middleware instead. When done, re-check: https://scanyoursite.app/en?check=app.example.com
Every merge can undo a fix
With Pro we notice each new deploy and check it within minutes, or call our deploy hook from CI. You hear from us only when something new breaks.
See plansQuestions
How do I connect it to Cursor?
Create an API token in your account and add ScanYourSite as an MCP server. Your agent can then list your sites, start a scan and read the report.
Why only a handful of paths for .env and .git?
Probing a server goes beyond what a browser does, so we only do it on domains you have proven are yours, and only for a short list of known leaks.
Does it scan my repository?
No. We check the live site. That catches what actually shipped, whatever the repository says.
Paste your URL. Get the list in about a minute.
Every finding comes with what it means for you and how to fix it — or a prompt your AI coding tool can apply.
Free, no sign-up. The basic check makes only the requests an ordinary browser would.