What changed
Cursor's Build Live Apps flow lets a cloud agent scaffold an application, provision Postgres and authentication, run security checks and publish to managed hosting. Team administrators can inspect applications and secrets, add review rules, approve blocked publishes and unpublish an app.
Why it matters
The coding agent now crosses from repository edits into managed infrastructure and a public endpoint. That compresses delivery, but it also concentrates database, secret, identity and publishing authority in one workflow.
What to do
Start with a disposable application and synthetic data. Require review rules for schema, authentication and publish actions; inspect generated secrets, database roles, outbound traffic and the final public endpoint, then prove unpublish and data-removal paths before production use.
Caveat
Cursor's changelog establishes the vendor feature and stated controls, not an independent security assessment. Managed hosting, Postgres and authentication availability may vary, and administrator visibility does not replace application-level authorization or data-governance review.