How to review Cursor code for security?

Review every function that handles user input for proper validation and sanitization. Check database queries for parameterized statements instead of string interpolation, and verify that authentication and authorization checks are present on all protected routes. Look for hardcoded secrets, insecure HTTP calls where HTTPS should be used, and missing error handling that could leak stack traces. Pay special attention to code that Cursor auto-completed, as these completions prioritize functionality over security. UNPWNED automates many of these security checks and can serve as a final verification after manual review.