Bookmark this before you launch your next AI-built MVP. Cursor...
Prajwal Tomar@PrajwalTomar_
43 views
Apr 09, 2025
~3 min read
Advertisement
1
Bookmark this before you launch your next AI-built MVP.
Cursor makes it easy to move fast.
But security? That’s still your job.
Here’s the exact checklist I follow before launching any AI-built MVP ↓
Cursor makes it easy to move fast.
But security? That’s still your job.
Here’s the exact checklist I follow before launching any AI-built MVP ↓
2
1. Rate limit your endpoints
If you skip this, bots or bad actors can hit your backend 100s of times per second.
This can:
- Crash your database
- Drain your Supabase usage
- Spike costs or open you to attacks
Tools to use:
- Supabase Edge Functions with a rate limiter
- Vercel Middleware
- Basic IP throttling with Next.js middleware
If you skip this, bots or bad actors can hit your backend 100s of times per second.
This can:
- Crash your database
- Drain your Supabase usage
- Spike costs or open you to attacks
Tools to use:
- Supabase Edge Functions with a rate limiter
- Vercel Middleware
- Basic IP throttling with Next.js middleware
3
2. Enable Row-Level Security (RLS)
If you’re using Supabase, turn on RLS on every table from day one.
Without it, users can query other people’s data.
And yes, this happens way more than you'd think.
To set it up:
- Go to Table → RLS → Enable
- Use policies like user_id = auth.uid()
No RLS = no data security.
Pro Tip: Try asking Cursor for these policies on the basis of your db design and your PRD, and Cursor will help you create these policies.
If you’re using Supabase, turn on RLS on every table from day one.
Without it, users can query other people’s data.
And yes, this happens way more than you'd think.
To set it up:
- Go to Table → RLS → Enable
- Use policies like user_id = auth.uid()
No RLS = no data security.
Pro Tip: Try asking Cursor for these policies on the basis of your db design and your PRD, and Cursor will help you create these policies.
4
3. Add CAPTCHA to your auth flows
AI bots can generate thousands of fake signups in minutes.
Add CAPTCHA to:
- Signup forms
- Login pages
- Forgot password flows
Use hCaptcha or reCAPTCHA. Both are quick to implement.
AI bots can generate thousands of fake signups in minutes.
Add CAPTCHA to:
- Signup forms
- Login pages
- Forgot password flows
Use hCaptcha or reCAPTCHA. Both are quick to implement.
5
4. Enable WAF (Web Application Firewall)
If you’re deploying with Vercel, you’re just 1 click away from basic protection.
Go to:
Vercel → Settings → Security → Web Application Firewall
Enable “Attack Challenge” on all routes
It blocks bad traffic before it hits your app. No code required.
If you’re deploying with Vercel, you’re just 1 click away from basic protection.
Go to:
Vercel → Settings → Security → Web Application Firewall
Enable “Attack Challenge” on all routes
It blocks bad traffic before it hits your app. No code required.
6
5. Secure your API keys and secrets
Never expose secrets in frontend code.
Instead:
- Store keys in .env files
- Use server-only functions for anything sensitive
- Scan AI-generated code (it often forgets this)
If it runs on the client, assume it's public.
Never expose secrets in frontend code.
Instead:
- Store keys in .env files
- Use server-only functions for anything sensitive
- Scan AI-generated code (it often forgets this)
If it runs on the client, assume it's public.
7
6. Validate all inputs on the backend
Don’t trust the frontend even if Cursor or Lovable does the UI validation.
Always validate:
- Emails
- Passwords
- Uploaded files
- Custom form inputs
- API payloads
A single missed check = potential vulnerability.
Don’t trust the frontend even if Cursor or Lovable does the UI validation.
Always validate:
- Emails
- Passwords
- Uploaded files
- Custom form inputs
- API payloads
A single missed check = potential vulnerability.
8
7. Clean up dependencies
Cursor moves fast. But it doesn't clean up after itself.
Before launch:
- Run npm audit fix or yarn audit
- Remove unused packages
- Check for critical vulnerabilities
- Use minimal dependencies to reduce your attack surface
Cursor moves fast. But it doesn't clean up after itself.
Before launch:
- Run npm audit fix or yarn audit
- Remove unused packages
- Check for critical vulnerabilities
- Use minimal dependencies to reduce your attack surface
9
8. Add basic monitoring and logs
You can’t fix what you can’t see.
Use:
- Supabase Logs
- Vercel Analytics
- Simple server-side logs with timestamps + IP
Track:
- Failed logins
- High traffic spikes
- 500s and unhandled errors
Even a basic log table in Supabase helps.
You can’t fix what you can’t see.
Use:
- Supabase Logs
- Vercel Analytics
- Simple server-side logs with timestamps + IP
Track:
- Failed logins
- High traffic spikes
- 500s and unhandled errors
Even a basic log table in Supabase helps.
10
Final Thoughts
Cursor lets you code fast.
But you’re still responsible for keeping your MVP safe.
Before you launch:
- Rate limit
- RLS
- CAPTCHA
- WAF
- Secret management
- Input validation
- Dependency cleanup
- Monitoring
Don’t skip this.
Cursor lets you code fast.
But you’re still responsible for keeping your MVP safe.
Before you launch:
- Rate limit
- RLS
- CAPTCHA
- WAF
- Secret management
- Input validation
- Dependency cleanup
- Monitoring
Don’t skip this.
11
TLDR
AI helps you build at lightning speed.
But skipping security will break trust just as fast.
Bookmark this checklist.
Revisit it before you go live.
Secure apps = sustainable growth.
AI helps you build at lightning speed.
But skipping security will break trust just as fast.
Bookmark this checklist.
Revisit it before you go live.
Secure apps = sustainable growth.
