Vibe coding
Cursor to production: the checklist for agent-built codebases
AI Cubed
September 9, 2026
9 min
Cursor is a professional tool that lets you skip professional habits for a surprisingly long time. The app runs; the problem is that nobody controls it. Agent mode has touched files across the tree, the same concern is solved three ways, imports reference APIs that don't exist, and every dependency update is a gamble.
This checklist restores control first and finishes the app second, because finishing an app you don't control produces more of the same. Each step says what "done" looks like.
The checklist, in order
- Commit everything; create a branch. Done when: main is protected and every change goes through a PR.
- Commit the lockfile; pin and reconcile framework versions. Done when: a clean install produces the same build twice.
- Strict TypeScript; fix every error. Done when: tsc passes with strict on and no new any.
- Write .cursor/rules with the project's patterns and boundaries. Done when: a new agent session follows the conventions without being told.
- Audit dependencies against real imports. Done when: nothing in package.json is unused or non-existent.
- Consolidate to one pattern per concern; delete dead code. Done when: there's one way to fetch data, one way to handle forms, one way to handle errors.
- Secrets out of repo and client; rotate anything found. Done when: git history and the client bundle contain no keys.
- Separate environments. Done when: you can break preview without touching production.
- Tests and CI on every PR. Done when: a PR that breaks checkout fails.
- Deploy from the repo with preview environments and rollback. Done when: you've rolled back once on purpose.
- Monitoring and backups. Done when: a test alert reached your phone.
- Review every AI diff before merge. Done when: it's been a month and it's still true.
Cursor-specific gotchas
| Gotcha | What happens | Fix |
|---|---|---|
| Agent mode edits shared files | Fixing one feature silently changes utilities and types used elsewhere. | Scope the agent in the rules file; review every diff; keep shared modules small and tested. |
| Mixed framework versions | Next 14 and 15 conventions in one app; routing or data fetching behaves inconsistently. | Reconcile to one major version; follow its conventions everywhere. |
| Hallucinated APIs | Imports or method calls that don't exist in the installed version. | Strict TypeScript; type-check in CI; audit dependencies. |
| Monorepo context loss | Half-finished cross-package refactors. | Complete by hand; scope agent tasks to one package. |
| Committed .env.local | Keys in git history for weeks. | Rotate, purge history, gitignore. |
What AI Cubed does about this
We run this checklist on Cursor-built projects: two-business-day audit, then stabilisation and completion, and a rules file so Cursor keeps helping. See finish my Cursor app.
Frequently asked questions
Sources
- Cursor documentation — Cursor
- TypeScript: tsconfig strict — TypeScript
Start here
See where your operation is losing time.
Twenty minutes with an operator, not a salesperson. We'll name the one bottleneck costing you the most — and tell you whether it's worth fixing with software at all.
Book your free 20-minute consult→20 minutes · video call · no preparation needed