Check the security of an app built in Cursor
Pick one generated change and trace it from the UI control to the server handler and database query. Then exercise that route with real test sessions. Cursor can locate the relevant code; only a test of the deployed revision shows its behavior.
What to prepare
Use the diff from a specific commit, a staging build and synthetic records. Keep .env files, access tokens and customer data out of the chat. Connecting MCP and approving a scan are separate actions.
Verification procedure
Ask the agent to locate the trust boundary
For an invoice download, request the file and function where the server derives the current user. Check the answer against the diff. A userId in a request body or a hidden button does not establish permission to read an invoice.
Replay the operation outside the UI
Open the invoice as its owner and revisit the same download in another test session. Record the status and whether the private marker appears. After a fix, repeat both requests on the new build.
A review prompt that needs no credentials
Trace invoice download from the button to the database call. Name the files and functions.
Where does the server get the identity and check permission for this invoice?
Propose a test with two fictional accounts. Do not run commands or change files.Decision and limitations
Attach the commit, route, before-and-after observation and test to the release ticket so another developer can repeat it.
What remains unverified
This establishes behavior for one route. Review other permission changes, newly exposed client-side values and dependency changes separately.