Make your Cursor-built app production-ready

• Every API key and secret lives on the server, never in frontend code
• Any key that was pasted into a prompt, a chat or a public repo has been rotated

In Cursor Search the repository for hard-coded keys, and keep .env files out of Git. A key committed once stays in the history until it's rotated.

• Permissions are enforced on the data, not just by hiding buttons
• Signed in as two different users, neither can see the other's records

In Cursor Read the auth code yourself. AI-written middleware can look right and still skip a route or trust a value the browser sends.

• Every table that holds user data has access rules
• Backups run, and one has been restored to prove it works

In Cursor Keep migrations in the repository and repeatable, and check that every query is scoped to the signed-in user. A missing filter is how one customer ends up seeing another's data.

• A separate staging environment, so changes don't go straight to real users
• The code lives in a Git repository you own, so every change can be reviewed and rolled back

In Cursor Review diffs before merging. Small, reviewed changes are far easier to roll back than one large accepted suggestion.

• Errors and downtime raise an alert, so you hear about problems before users do
• Failed payments, logins and AI calls are logged where a person will see them

In Cursor Add error tracking and uptime alerts to production, and log failed logins and payments. Cursor can write the setup; someone still has to watch the alerts.

• Usage limits stop a runaway loop or a heavy user from running up the bill
• The right model for each task, with caching where answers repeat

In Cursor If the app calls AI models, set limits and choose the model per task, not the largest one for everything.