Deckproof
DE
00 / Free check for sites made with Cursor

Your Cursor app is live. Is it safe, legal, and solid?

Hand-rolled code means the footguns are yours to check. Paste the address and in 30 seconds you get a grade, what is wrong in plain words, and the exact text to paste back into Cursor to fix it.

PASTE YOUR SITE'S ADDRESS
https://
No signupWe only look, we change nothingYour pages are not stored
01 / What usually goes wrong on Cursor

The defaults that bite.

These are the mistakes we see most on sites built with Cursor. Not your fault: they are what the builder does unless you tell it otherwise.

01Whatever backend you wired up needs its own access control (RLS or equivalent).
02Secrets management and security headers are entirely on you.

The fix, in short

Run the full scan, it treats your site as a black box regardless of how it was built.

02 / What the scan covers

The same 112 checks, whatever built your site.

A sample from each area. See every check.

SECURITY
A-01
Anyone can read your database
Your Supabase table answers to anyone who asks, no login needed. That is your users' data, readable by strangers. We ask once for a count only, never for a row, and report what came back.
CRITICAL
A-04
Your Firebase database is open
Your Firebase data can be read without logging in.
CRITICAL
S-01
Your master key is inside the page
The Supabase service key sits in your site's code. Whoever reads it owns your whole database, every lock ignored.
CRITICAL
EU LEGAL INFORMATION
DE-IMP-01
No Impressum found
German law expects a provider page on commercial sites (§5 DDG). We say what we found and link the rule. General information, not legal advice.
HIGH
DE-PRIV-01
No privacy notice found
EU law expects one (Art. 13 GDPR). We look for a linked page under the usual names. General information, not legal advice.
HIGH
DE-IMP-04
Impressum is empty until JavaScript runs
The Impressum page exists, but the server sends it almost empty and the details only appear once JavaScript has run. With JavaScript off, in an archive, or to an automated check the page reads as blank. General information, not legal advice.
MEDIUM
QUALITY
Q-16
A file could not be checked
Our own request for robots.txt, sitemap.xml or the favicon got no answer, so we say that instead of claiming the file is missing. Costs no points.
LOW
Q-01
Search engines are told to stay away
A noindex tag or header, or a robots.txt that blocks everything, is still on. Preview builds ship with it; a launched site with it is invisible.
HIGH
Q-05c
Title is still the template default
The tab reads "Vite + React" or "Lovable App". That is the headline of your search result.
MEDIUM