# Cursor Changelog Says Cloud Agents Can Scaffold and Deploy Live Web Apps After Security Checks

Times of AI Desk · 2026-11-07 · Products

[https://timesof.ai/2026/11/cursor-build-live-apps-cloud-agents](https://timesof.ai/2026/11/cursor-build-live-apps-cloud-agents)

> Cursor's November 5 changelog says users on paid plans with cloud agents enabled can ask a cloud agent to build a live web app: scaffold the app, provision a Postgres database if needed, configure authentication behind Cursor SSO, and deploy hosting at a URL the user chooses. Cursor says deterministic and agentic security checks run before publish, and that nothing goes live until those checks pass and the user explicitly publishes. Team admins can see apps and secrets, add their own review rules and unpublish an app. Apps can start from a new Cursor Origin repository or an existing GitHub repo, the changelog says.

Cursor's changelog for **November 5** describes a path from a natural-language prompt to a hosted web app, limited to paid plans that already have cloud agents turned on. According to that post, a user can start a cloud agent and say they want to build an app; the agent will scaffold a web app, spin up a **Postgres** database if needed, set up authentication behind **Cursor SSO**, and provision hosting. When the user publishes, they pick a domain and receive a live link. If the app needs secrets for other systems, Cursor says it will ask for them.

The same changelog says publishing is gated. Cursor says it runs deterministic and agentic security checks for issues such as secrets written into app files or exposed credentials; if a check fails, the agent reports what it needs to fix, and "nothing goes live until the checks pass and you explicitly publish the app." Team admins, it says, can see every app and secret on the team, add their own rules to the security review, approve publishes that the review blocked, and unpublish any app. Sharing can be limited to specific people, groups or a whole team behind Cursor sign-in; on individual plans, apps can also be shared publicly, the post says.

Cursor says apps can be deployed from new or existing repositories on **Cursor Origin** and **GitHub**, with support for other git providers such as GitLab "coming soon." It also says a Cursor API key can be provisioned if a script or Grok Bot should call the app. The feature is "now available on all paid plans with cloud agents enabled," according to the changelog.

This is a product changelog, not an independent security audit of the new deploy path. Cursor separately documented a [marketplace incident involving tampered Claude Code extension versions](https://timesof.ai/2026/10/cursor-marketplace-tampered-claude-code-extension-5000-users); that episode is unrelated to this feature except as prior company reporting on its distribution surface.

## Limits

- All capability, pricing-tier and security-check claims are from Cursor's changelog. We have not used the feature or reviewed the checks.
- "Coming soon" GitLab support is a stated intention, not a shipped integration.
- The changelog does not detail what the deterministic or agentic checks cover beyond common secret-exposure examples, nor how they fail closed.
- Availability is limited to paid plans with cloud agents enabled; the post does not list prices here.

## Sources

- [Cursor changelog: Build Live Apps in Cursor (November 5, 2026)](https://cursor.com/changelog/build-live-apps)