You built it in a weekend. Before you charge money for it, check what Cursor skipped.
Cursor is incredible at generating features. AI-generated code can skip the security checks around those features, and XploitScan looks for many of those skipped checks.
If any of this sounds like you
- →You built a SaaS with Cursor in a weekend and it works
- →Paying customers are about to use it and you're quietly nervous
- →You don't have a security engineer, a budget for a pentest, or three weeks to read OWASP
- →You can't tell whether Cursor's Stripe webhook handler is safe because you don't know what “safe” looks like
- →You'd rather find out about security holes now than from a Hacker News post about your app
Here's what you get in five minutes
223 rules tuned for AI code
Rules written for the patterns that show up in AI-generated apps, from missing auth on API routes to secrets in client bundles. The free tier runs 30 of them; paid plans run all 223.
Plain-English findings
Each finding explains what an attacker can actually do, in one sentence. No CWE jargon.
Suggested fixes
Every finding comes with a suggested fix, often a code change you can paste back into Cursor.
Cursor security rules
Copy XploitScan's Cursor ruleset into your project's Cursor rules, so Cursor's Agent is instructed to avoid these bugs when it works on your code.
One real bug to check for before you ship
If you asked Cursor to “add Stripe payments”, check whether your webhook handler verifies signatures. Without that check, anyone with your webhook URL can send a fake “payment succeeded” event and credit themselves $10,000 of your product. No payment actually goes to Stripe. Your dashboard looks fine. The first time you notice is when margins crater.
We wrote the full walkthrough here, including the fix. XploitScan's VC005 rule checks for exactly this bug, and it runs on the free tier.
Two minutes, zero install
Paste a file into the browser demo, or run npx xploitscan@latest scan . on your whole repo (free rule set, no account), and get back a grade, findings and suggested fixes. No credit card. No signup.