How to security test Cursor-generated projects?

Start with static analysis using tools like ESLint security plugins to catch common patterns like eval() usage and hardcoded secrets. Then deploy to a staging environment and run dynamic analysis that tests your running application for vulnerabilities like XSS, injection, and broken access control. Check your dependency tree for known CVEs using npm audit or similar tools. Review all environment variable handling to ensure secrets are not bundled into client-side code. UNPWNED combines static and dynamic analysis in a single scan, running 700+ security checks across 40 scanners relevant to modern web applications built with AI assistance.