Cursor AI Production-Ready Checklist: 12 Things to Verify Before You Ship

Why you need a checklist

Cursor is fast. Dangerously fast. You can go from idea to deployed feature in an hour. The problem is that speed compresses the review time where most bugs get caught. A checklist is the cheapest safety net you can add.

The 12-point checklist

1. All async functions have try/catch — check every API call and database query
2. Input validation on all user-facing fields — type, length, format
3. Environment variables are not hardcoded — search for API keys, secrets in the diff
4. Auth middleware applied to all protected routes — not just the ones you remember
5. Error states render gracefully in the UI — users see something useful, not a white screen
6. Loading states exist for all async operations — no button double-submit bugs
7. Database queries have proper indexes — easy to miss on first deploy, kills perf at scale
8. Rate limiting on public endpoints — AI rarely adds this by default
9. CSP headers configured — protects against XSS from third-party scripts
10. Logs don't contain PII — console.log(user) leaks everything
11. Error monitoring is installed — you need visibility the moment you ship
12. At least one alert is configured — know when something breaks

Automate the safety net

Items 11 and 12 deserve special attention. Error monitoring isn't something you add after things break — it's infrastructure. Add ProdFix to your project template so every new project starts with monitoring already in place.

The MCP shortcut

Once ProdFix is connected to Cursor via MCP, you can ask Cursor: "are there any production errors in the last 24 hours?" and get a real answer with stack traces. That feedback loop is what turns fast shipping into safe shipping.