Cursor App Production Checklist

Cursor-specific concerns: verify no localhost URLs in production code, ensure all API routes require auth, confirm environment variables are properly separated, and check that server actions validate input before database operations

Authentication protects all private routes and API endpoints. Input validation on every form and data handler. No API keys or secrets in client-side code. Security headers configured (CSP, HSTS, X-Frame-Options). CORS restricted to your domain. Rate limiting on login and signup endpoints. HTTPS enforced everywhere.

Images optimized and lazy-loaded. Code splitting implemented. Lighthouse performance score above 80. Database queries have indexes on filtered columns. Pagination on all data lists. Static assets served with cache headers. No unnecessary client-side JavaScript.

Error tracking configured (Sentry or similar). Custom error pages for 404 and 500 errors. Error boundaries catch rendering failures gracefully. Loading states on all async operations. Graceful handling of network failures. Health check endpoint for monitoring. Database backups configured.

Environment variables configured for production (no hardcoded URLs). All API routes and server actions require authentication. Input validation on all server-side data handlers. Error boundaries at route segment level. Security headers configured in next.config.ts. Database queries use parameterized statements. No sensitive keys in NEXT_PUBLIC_ variables. Rate limiting on auth endpoints. Custom 404 and error pages. Monitoring and error tracking (Sentry or similar). Image optimization with next/image. Loading states for all async operations. CORS restricted to your domain. Proper cache-control headers. SSL enforced on all routes

Launching without monitoring is like driving without a dashboard - you won't know something is wrong until it's too late. Set up Sentry (free tier available) for error tracking: it captures every unhandled exception with full context including the user's browser, the request that triggered it, and the exact line of code that failed. This alone will save you hours of debugging because users rarely report errors with enough detail to reproduce them. Add uptime monitoring with UptimeRobot, Better Stack, or Pingdom - these services ping your site every few minutes and alert you immediately when it goes down. For log aggregation, your hosting platform's built-in logs work for small apps, but as you scale, a dedicated service like Datadog or LogTail makes it possible to search and filter logs across time periods. Set up alerts for three critical scenarios: your site goes down, your error rate exceeds 1% of requests, or your API response time exceeds 3 seconds. Route these alerts to Slack or email so you can respond quickly without checking dashboards manually.

If your database disappears tomorrow, can you recover? Most Cursor apps don't address this until it's too late. If you're using Supabase, automated daily backups are included on paid plans, with point-in-time recovery available on Pro plans and above. For other databases, configure automated backups through your hosting provider or set up pg_dump on a cron job for Postgres. Test your backups by actually restoring one to a test environment - a backup you've never tested is not a backup. Beyond the database, document everything needed to rebuild your app from scratch: environment variables, third-party service configurations, DNS settings, and deployment steps. Keep this in a private document outside the app itself. Have a rollback plan for bad deployments: know how to revert to the previous version on your hosting platform (most keep deployment history). For Stripe webhooks and other integrations, understand that rolling back code doesn't roll back data changes, so your recovery plan needs to account for data that was modified between the bad deploy and the rollback.

Our security scan ($19) and code audit ($19) check for all of these issues automatically. Upload your code and get a detailed report within 24 hours. If you need help fixing what we find, our team is here for that too.