Skip to content
SSShipSafeStack

Ship guide

Ship a Cursor app

Cursor works in the repo you opened. It will not pick your host or turn on database policies unless you ask, and it will sometimes do those tasks badly if you ask in one sentence. This list is the review after the agent stops.

Updated 16 Oct 2026 · Directory entry

A checklist for this builder, not a promise the app is production-safe. Confirm every setting in the project you actually generated.

  1. 01

    Read the diff before you commit

    Look at every file the agent touched, including lockfiles. Socket or GitHub Advanced Security should be on if the agent can add packages. A dependency bump is part of the change.

  2. 02

    Search for secrets the agent may have written

    Agents inline keys to make a script run. Run the API key checklist on the branch. Rotate anything that hit git, even for a minute.

  3. 03

    Ask where this deploys

    If the answer is Vercel, Netlify, Cloudflare, or the builder you started from, open that dashboard and compare env vars to the code. Public prefixes are public.

  4. 04

    Check authorization, not just authentication

    A login screen is not access control. For Supabase, use the RLS checklist. For your own API routes, call them while logged out.

  5. 05

    Add the production basics

    Rate limiting, a verified payment webhook if you charge, and error monitoring. Then the pre-launch checklist.