Code written with Cursor: how to check its security
With Cursor, you accept dozens of changes an hour. Nobody reviews every line, and that’s normal. The problem is that the AI reproduces the patterns it has seen: SQL queries built by concatenation, hard-coded secrets, packages installed in an old version.
The answer isn’t to slow down, but to add an automatic check: an analysis that reviews the whole project against OWASP and CWE at each important step, and tells you what to fix first.
Ten free analyses every month, no card needed. First report in minutes.
Analyse my app for freeThe most common flaws
Hard-coded secrets
A key pasted into the chat “to test quickly” ends up in a file, then in Git history. It stays usable even after you delete it.
SQL and command injections
A query built from a string, exec() with user input: classic mistakes the AI happily reproduces.
Old or vulnerable dependencies
Models suggest the versions they know, sometimes years old and hit by published CVEs.
Poorly protected passwords
MD5 or SHA-1 hashing, session cookies without HttpOnly or Secure: details that matter the day there is a leak.
What Citadel checks (24 live checks)
Code, dependency and secret analysis against OWASP and CWE. Every flaw comes with a plain explanation and the fix prompt to paste into your assistant.
- Next.js version vulnerable to middleware bypass (CVE-2025-29927) A06 · CVE
- Secret exposed in a NEXT_PUBLIC_ variable CWE-200 · A02
- dangerouslySetInnerHTML fed with external data CWE-79 · A03
- Redirect built from URL parameters CWE-601 · A01
- images.remotePatterns open to every domain CWE-918 · A10
- Source maps published in production CWE-540 · A05
- child_process.exec or spawn with user input CWE-78 · A03
- eval, new Function or vm on external data CWE-95 · A03
- File path built from the request (path traversal) CWE-22 · A01
- JWT verified without an algorithm allow-list or with a weak secret CWE-347 · API2
- Session cookies without HttpOnly, Secure or SameSite CWE-1004 · CWE-614
- CORS: * origin combined with authentication cookies CWE-942 · A05
- Secrets in the code and config files (100+ key types) CWE-798 · A07
- npm and Composer dependencies with published CVEs or GHSA advisories A06 · CVSS
- Passwords hashed with MD5, SHA-1 or unsalted CWE-916 · A02
- http:// redirects to https:// CWE-319 · A02
- HSTS present with a sufficient duration CWE-319 · A05
- CSP present, without unsafe-inline or unsafe-eval CWE-693 · A05
- Protection against embedding in another page (clickjacking) CWE-1021 · A05
- Secure, HttpOnly and SameSite cookies CWE-614 · CWE-1004
- CORS open to every site with cookies CWE-942 · A05
- nosniff and Referrer-Policy headers, server version hidden CWE-693 · CWE-200
- Forms sent in clear text, or password passed in the URL CWE-319 · CWE-598
- Forms without an anti-CSRF token, or sent to another domain CWE-352 · CWE-201
Frequently asked questions
Does Cursor check my code’s security?
It can if you ask it to, but only on demand and not systematically. Citadel applies the same deterministic checks to the whole project on every analysis: the same code always gives the same result.
Is my code kept?
No. It is analysed in an isolated container with no internet access, then deleted as soon as the analysis ends. Only the results are kept, with secrets masked.
How much does it cost?
The Free plan includes ten analyses a month, no card needed. Paid plans add Citadel AI, analysis on every push and team work.
Other guides
Vibe coding security: the checklist before you put your app online