What’s different about these tools
Cursor works inside your own code, and you choose where the app runs and where its data lives. v0 builds the app and can put it live on Vercel in one click. Either way, the decisions about keys, logins and data are still yours to check.
Four things to check
Secret keys stay out of the browser
Settings that start with NEXT_PUBLIC_ or VITE_ are copied into the code every visitor downloads. A database password, Stripe secret key or AI key must never have that prefix.
Secrets stay out of your code history
Settings files like .env shouldn’t be saved in your repository. If one was, replace the keys in it. Deleting the file later doesn’t undo it.
The server checks who’s asking
Every request that reads or changes private data needs its own check. A page that looks locked can still have an open request behind it.
Payments are confirmed by the payment provider
Your app should only mark something paid after a verified message from the provider, never because the browser said so.
How to check without reading code
- Run a free scan of your live site. It shows secret keys in the website and missing browser protections.
- Sign up as two test users, and try to reach one’s data while logged in as the other.
- If you use a database like Supabase, open its security check and fix what it lists.
- Ask your AI tool to review its own work, and treat what it says as leads to check, not proof.
When to ask an engineer
A scan only sees the outside of your app. Before you take payments or store personal data, have someone read how the logins, data rules and payments really work.