Does Cursor generate secure API endpoints?

Cursor-generated API endpoints frequently lack comprehensive security measures. Common omissions include missing rate limiting, absent CORS configuration, no input validation middleware, and insufficient error handling that may expose internal details. The AI tends to generate the happy path - code that works when given expected input - without adding defensive checks for malicious or malformed requests. API endpoints are the primary attack surface for web applications and require careful security review. UNPWNED checks common public API paths for reachability, exposed response data, headers, CORS, rate-limit, and error-disclosure signals. Authentication and input-validation logic require separate testing.