Security checklist for Cursor, Bolt, and v0 apps

Before you deploy

1. Search the repo for sk_, AKIA, service_role, and committed .env files.
2. Ensure production builds do not ship source maps if you care about source exposure.
3. Set security headers (CSP, HSTS, X-Frame-Options, nosniff) at the host (Vercel/Netlify headers are fine).
4. Put Stripe/OpenAI/Anthropic calls behind server routes with private env vars.
5. Turn on provider billing alerts so a leaked key cannot quietly drain money.

After you deploy

Run a public-surface scan on the live URL (not only localhost). PreflightVibe is built for that moment: paste the production link, get findings plus Cursor/Lovable fix prompts.

Background reading: leaked keys and open Supabase projects show up repeatedly in vibe-coding write-ups such as Wiz on Moltbook and SymbioticSec’s scan.