Does Cursor generate secure API endpoints?

Cursor-generated API endpoints frequently lack comprehensive security measures. Common omissions include missing rate limiting, absent CORS configuration, no input validation middleware, and insufficient error handling that may expose internal details. The AI tends to generate the happy path - code that works when given expected input - without adding defensive checks for malicious or malformed requests. API endpoints are the primary attack surface for web applications and require careful security review. UNPWNED scans your API endpoints for authentication gaps, missing headers, CORS misconfigurations, and rate limiting absence.