How to security test Cursor-generated projects?

Start with static analysis using tools like ESLint security plugins to catch common patterns like eval() usage and hardcoded secrets. Then deploy to a staging environment and run dynamic analysis that tests your running application for vulnerabilities like XSS, injection, and broken access control. Check your dependency tree for known CVEs using npm audit or similar tools. Review all environment variable handling to ensure secrets are not bundled into client-side code. UNPWNED's 702-check outside-in web suite runs across 33 coverage scanners plus a supporting endpoint-discovery pass after current ownership proof; the read-only GitHub integration is a separate connected-code workflow. SQL-injection, reflected-XSS, and path-traversal probes are not enabled in the current production profile.