Who can secure my Cursor app?

What does PatchAndShip fix in a Cursor app?

Cursor works on your own codebase. From our checklist:

• Secret or service_role keys in the client bundle or repo.
• Secrets under public env prefixes (VITE_*, NEXT_PUBLIC_*).
• Row Level Security off or wide open on Supabase tables.
• Public storage buckets holding private files.

Full list: What we check and fix.

What changes when I deploy?

Fix & Deploy deploys your Cursor app's frontend to Vercel or Netlify. If your app has a separate Node/Express server, it stays where it already runs. We fix its code and settings, and deploying a separate server is quoted separately.

Public VITE_ and NEXT_PUBLIC_ values are baked in at build time, so change them on the host and rebuild. Vite SPAs need a catch-all rewrite to /index.html on Vercel or Netlify. Set the Supabase Site URL to your production URL for auth redirects.

What access does PatchAndShip need?

Least-privilege access only: collaborator access on your GitHub repo, a Supabase org invite with the lowest role your plan allows, and for Vercel a guided handoff or a scoped, expiring token. We never ask for passwords, tokens are shared only via a one-time link, and at handoff you revoke our access (we send a checklist).

For Cursor, we don't need access to your Cursor account: add us as a collaborator on the one GitHub repository, and invite us to your Supabase organization with the lowest role your plan allows. If a secret was ever committed to the repo, you must rotate it after delivery. Removing us and rotating your keys are both on the revoke checklist we send.

For Vercel, you don't need to buy a seat or invite us to your team: we give you a deploy-ready repo and an env-var checklist, then either walk you through a short guided handoff with the exact clicks, or use a scoped, expiring Vercel access token you share through a one-time link, never your password.

For Netlify, you don't need to add us to your team: we give you a deploy-ready repo and an env-var checklist and walk you through a short guided handoff with the exact clicks, never your password.

What does it cost, and what if it isn't done in 48 hours?

Two fixed prices per app, paid once:

Within 48 hours of working access or a full refund. The 48 hours start when PatchAndShip gets working access, and the clock pauses while we're waiting on you, for example on DNS.

Fix & Deploy deploys your Cursor app's frontend to Vercel or Netlify. If your app has a separate Node/Express server, it stays where it already runs. We fix its code and settings, and deploying a separate server is quoted separately. Each order covers one app, one Supabase project (or one Node app, as defined in our Terms) and one deploy target. Apps with more than 25 user-defined tables are declined or quoted separately. No new features. Not a penetration test or compliance certification.

Can I start with a free check?

Yes. PatchAndShip's free mini check is passive: it looks only at the public homepage, its scripts and its security headers, and nothing else. It flags exposed secret keys, missing headers and public storage links found in the code (the bucket itself is never opened or listed). No database queries, no logins, no changes. It returns a one‑page summary within 24 hours. It's for app owners, or someone the owner has authorized.

Request the free check

Can I fix it myself instead?

Yes. Start with the free Supabase RLS checklist, then Supabase error 42501: the safe fix. For keys committed to git, follow GitHub's guide and rotate the key first.

Where do these facts come from?

1. Cursor Docs: Ignore file. .cursorignore blocks Agent, Tab, Inline Edit, @-mentions; not guaranteed
2. Cursor Docs: Rules. Project rules and AGENTS.md
3. GitHub: Removing sensitive data. Rotate secrets before rewriting history
4. Supabase Docs: API keys. Secret vs publishable keys
5. Cursor Docs. What Cursor is.
6. Vite: Env Variables and Modes. VITE_ variables are public and fixed at build time.
7. Next.js: Environment variables.
8. Vercel Docs: Vite on Vercel. SPA deep links.
9. Netlify Docs: Rewrites and proxies. SPA rewrite.
10. Supabase Docs: Redirect URLs.
11. PatchAndShip service details: pricing, Refund Policy, Terms.

All sources checked on 2026-10-15. PatchAndShip's own guidance and service details are labeled as ours.