Cursor to production
Cursor doesn't generate a stack — it edits yours, prompt by prompt, and every prompt is a chance for the architecture to drift. Here is what a Cursor-built codebase looks like after three months of shipping, and how we get it back into a shape you can keep moving in.
Cleaning up a codebase built with Cursor means resolving what dozens of independent prompts left behind: three ways of doing the same thing because each session picked its own, `any` wherever a type got in the way, tests that mock the code under test and so pass regardless, half-finished refactors, secrets committed in `.env`, and dependencies added once and never used again. Gen2Prod audits the repo for free, fixes what matters by pull request at a fixed price from $290, and leaves rules files so Cursor keeps the new shape instead of eroding it.
The list we find on most Cursor projects, in the order it matters. Each one links to the service that fixes it.
Data fetching in hooks here, in server components there, in a `utils/api.ts` somewhere else — each from a different session. We pick one, migrate the rest, and write it down so Cursor follows it.
Fixed by Refactor & cleanupCursor writes tests when asked, and when a test is hard it mocks the thing being tested until it passes. We find the hollow ones, delete or rewrite them, and put real coverage on the paths that earn money.
Fixed by Refactor & cleanupEvery place the compiler complained, `any` made it stop. We generate types from your schema and put them at the boundaries — API responses, form inputs, database rows — so the editor catches the mismatch instead of your users.
Fixed by Refactor & cleanupAn `.env` committed in week one, a key pasted into a config to make a test run. We scan the history, rotate what's exposed, and move secrets to a managed vault with the client bundle checked for leaks.
Fixed by Security hardeningThe admin page checks `user.role` before rendering; the API route it calls checks nothing. We move every authorisation decision to the server and cover it with a test.
Fixed by Security hardeningDeploys from a laptop, no CI, no preview environment, and a `main` that's sometimes broken. We add a pipeline that runs the tests and deploys on merge, with a rollback path.
Fixed by Deploy & CI/CDA cleanup isn’t a rebuild. Cursor did real work, and most of it stays.
Because 'works' and 'safe to charge money for' are different bars. A Cursor-built app typically works for the happy path you tested, while the API routes accept anything, the tests pass for the wrong reasons, and a change in one place breaks another because the same logic exists three times. The free audit tells you which of these you have and what each one costs to fix — and if the answer is 'not much', we'll say so.
No. Rewrites are the expensive way to lose behaviour you've already paid for. We pin the current behaviour in tests, then restructure in small reviewable commits. Cursor's code at the function level is usually fine; the work is in the boundaries, the duplication and the conventions.
Yes, and it's part of every Cursor engagement. We leave a rules file that states the conventions we established — where data fetching lives, how errors are handled, what a test must actually assert — so the next prompt follows the structure instead of eroding it. Clients tell us Cursor breaks noticeably fewer things per prompt afterwards.
Yes. The tools differ but the drift is the same: independent sessions, each with its own idea of the architecture. Everything on this page applies, and Claude Code has its own page because its failure modes are slightly different.
Start with the free audit. In 48 hours you'll know what's broken, what each fix costs, and whether it's even worth doing — before you've spent a dollar.
Free audit, no card · Fixed price before we start · Your code stays yours