Cursor's agent can edit dozens of files in one pass, and it optimizes for working, not for secure. Keys land in source files, tables ship without access rules, packages get invented. Ascertify reads your repo and shows you what's actually in there: in plain English, pinned to the exact file and line, before real users arrive.
Connect your GitHub repo or upload a zip. Read-only access. We never run your code, and it's deleted after the scan.
A live payment key was committed five months ago. The file was deleted later, but git keeps every version: anyone with access to the repo can recover it with one command.
Unlike a managed platform, Cursor gives you no guardrails: no publish check, no automatic key protection, no default backend rules. You get exactly the code the agent wrote and you approved, at speed. These are the mistakes that survive that speed.
“can someone steal my OpenAI / Stripe / database keys?”
The agent frequently pastes keys directly into code instead of referencing environment variables. Anything in frontend code ships to every visitor's browser, one dev-tools click away.
“I deleted that .env file. Am I fine?”
No. Git remembers. A key committed once is recoverable by anyone with repo access, even after the file looks removed. We scan the full history, not just the current files.
“can users see each other's data?”
The agent creates tables and routes, then skips the row-level security policy or the Firebase rules. The app works perfectly while you're the only user. That's exactly why the problem stays invisible until launch.
“did the AI invent a dependency?”
AI models suggest plausible-sounding package names that were never published. At best the project won't install cleanly. At worst, an attacker registers that exact name and waits for someone to install it.
“could another developer, or future me, take this over?”
No setup instructions, no record of the database structure, no tests. When the whole build lives in your chat history with an agent, the repo itself has to carry the knowledge. Often it doesn't.
Cursor's security tooling is real, and if you work in pull requests on a team, use it. Bugbot is a paid, PR-based reviewer: it reads each diff as it's proposed and flags likely bugs before merge. That's a different job than ours, and it quietly assumes a workflow most solo builders don't have.
| cursor bugbot | ascertify | |
|---|---|---|
| What it looks at | Each pull request's diff | The entire repo, as it exists today |
| When it runs | On every PR, continuously | Once, before you launch or hand off |
| Who it's for | Engineering teams with review workflows | Solo builders and founders, no PR flow needed |
| Price model | Paid add-on, usage-based billing | One-time payment per scan |
| Discovery method | Agentic AI review | Deterministic tools find; AI only explains |
| Committed secrets in git history | Not its job | Full history scan |
| Hallucinated / nonexistent packages | Not its focus | Registry existence check |
| Setup completeness, migrations, handover readiness | Not its job | Covered |
| Output | Inline PR comments for developers | A plain-English report with file-and-line evidence, forwardable to anyone |
The short version: if you commit straight to main and deploy, which is how most Cursor solo builds work, Bugbot never sees your code at all. Ascertify audits the accumulated result: everything the agent wrote across every session, as one snapshot, explained in language you don't need a security background to act on.
Point Ascertify at the GitHub repo you've been building in. Read-only, revocable anytime. Zip upload works too, though repo connection lets us scan git history.
Deterministic checks, no guesswork. Every finding shows the exact file, line, and snippet that triggered it.
Each finding comes with a recommended first step, written so you can hand it straight to your agent. Review each change it makes before accepting.
You built this in a week of late nights and a Cursor subscription. Knowing it won't leak your users' data costs $49, once.
Free preview
A count of the critical findings in your code. Enough to know whether there's a problem worth raising, before you pay for the detail.
Run free previewEvery finding with file-and-line proof, the exact code, a plain-English explanation, a recommended first step, and a PDF you can forward to your developer.
Get full report ($49)Cursor is a capable tool, but AI-generated code optimizes for working, not for secure. Common issues in Cursor-built apps include hardcoded API keys, missing database access rules, and dependencies that don't actually exist. None of these stop the app from running, which is exactly why they ship. An independent scan of the finished repo is how you find them before users do.
Your project is already a git repository, so it takes two steps: push it to GitHub if it isn't there already, then point Ascertify at the repo with read-only access. The scan reads the code without running it and the free preview shows how many critical findings exist before you pay anything.
Cursor offers Bugbot, a paid AI reviewer that comments on pull requests as your team proposes changes. It's a continuous review tool for PR-based workflows. Ascertify is different: a one-time, whole-repo audit of the finished state, using deterministic tools rather than an AI reviewer, with checks Bugbot doesn't do (secrets in git history, hallucinated packages, handover readiness), reported in plain English. If you commit straight to main without pull requests, PR-based tools never see your code at all.
Missing or misconfigured database access rules, most often row-level security (RLS) on Supabase tables. The AI creates the tables and the routes but skips the policy that stops one user from reading another user's data. The app works fine in testing because you're the only user.
No, never. Your code is pulled read-only into an isolated sandbox, read as text, and deleted when the scan completes. We never execute it, install its dependencies, or build it. The report keeps only the findings and the snippets that prove them.
We're a static scan, not a penetration test. We don't probe your live app, test authentication at runtime, or verify how your access rules behave with real requests. Every report tells you exactly what we checked and what we didn't, because a clean result on a hidden checklist is worthless.
Usually, yes. Each finding includes a plain-English explanation and a recommended first step written so you can paste it into Cursor's agent. Review each change before accepting it, then confirm the issue is resolved.
The free preview takes a few minutes and tells you whether there's anything worth worrying about. Start there.
Scan my repo, free previewRead-only access · code deleted after the scan · one-time payment, no subscription