Public env vars
Anything prefixed for the client is in the bundle. The scan looks for live Stripe keys, OpenAI keys, AWS key IDs, GitHub tokens, and private key blocks.
For Cursor users
You shipped from Cursor. This is what the preview hid.
Cursor is excellent at making the feature work. It will not reliably notice a NEXT_PUBLIC secret, a missing HSTS header, or a homepage that is still noindex. Paste the production URL. The free scan lists the problems. Nine dollars unlocks a prompt you can drop back into the repo.
Headers the framework does not set
A default Next.js app does not send HSTS, CSP, or a frame policy unless you add them. Each missing header is its own fix.
The launch checklist
Title, description, canonical, sitemap, and a real 404 are easy to skip when the goal was to deploy before dinner.
What the scan looks for
- Secrets in first-party JavaScript
- Security headers
- Indexability and metadata
- Core Web Vitals via PageSpeed
- Exposed .env or .git paths
Does this read my repository?+
No. The only input is the public URL. We fetch the homepage, a handful of same-site scripts, and a few well-known paths.
Is the prompt specific?+
Each paid fix names the issue and the steps. You still review the diff. The prompt says not to print secrets.