What 285 public Cursor apps are leaking
We ran Shippable's static source checks over 285 public GitHub repos built with Cursor — reading committed code only, never touching anyone's live app. An editor, not a one-shot generator — most repos are hand-steered, so backend misconfigs are rarer and secrets dominate what's left.
- 01Secrets made with Math.random() · 11.6% of appsPassword-reset tokens and API keys generated with a predictable random source an attacker can guess.high
- 02.env committed to git · 9.5% of appsReal API keys and database passwords sitting in the repo's history for anyone to read.high
- 03Hard-coded fallback secret · 6.3% of appsCode like process.env.SECRET || "dev-secret" that silently ships the weak default to production.high
- 04Hard-coded secret in source · 3.2% of appsA live secret key written directly into committed code.critical
- 05Source maps published · 2.8% of appsSource map files that hand anyone your original, readable code.low
- 06DB function with no fixed search_path · 2.1% of appsA security-definer function an attacker can hijack by shadowing a table or function name.medium
Plus 26 more check types seen less often.
See which of these your app ships
Paste your app's URL. It's free, read-only, and takes about a minute.
Compare all five builders: which AI builder ships the safest apps.
How we measured this
We found public GitHub repositories carrying the .cursorrules file and ran Shippable's static source checks — the same code-level checks in npx shippable — over each one's committed files. We read source only: no live app was scanned and nothing was probed over the network. Figures are the share of 285 repositories where a given check fired at least once, aggregated so no repository, owner or finding is identified.