How to security test Cursor-generated projects?

Start with static analysis using tools like ESLint security plugins to catch common patterns like eval() usage and hardcoded secrets. Then deploy to a staging environment and run dynamic analysis that tests your running application for vulnerabilities like XSS, injection, and broken access control. Check your dependency tree for known CVEs using npm audit or similar tools. Review all environment variable handling to ensure secrets are not bundled into client-side code. UNPWNED's 721-check external web suite runs across 36 scanners after current ownership proof plus explicit active-testing authorization; the read-only GitHub integration is a separate connected-code workflow.