All news
VIBPS / NEWS • DEVELOPER TOOLS

Can Cursor build and publish a live app? How sharing and review work

Cursor's new cloud-agent flow can scaffold, host and publish a web app. Public sharing depends on the plan and team settings, and a passing security review is only one part of checking an app.

Cursor announced Build Live Apps on November 5, 2026. A maker can ask a Cursor cloud agent to create a web app, preview it, run publication checks and put it at a live URL. Cursor says the flow can provision hosting, a Postgres database when needed and sign-in for private apps. This is a route from an idea to a shareable tool, but the maker still has to choose to publish it. VIBPS has not built or deployed an app through Cursor's new flow firsthand.

How does a Cursor app get from prompt to link?

Cursor's documentation says to start a cloud agent and explicitly ask it to build an app. The agent can work from a new repository or an existing GitHub repository, prepare the app and show a preview. The maker then chooses a URL and starts publication. This Apps feature does not run from a local Cursor agent. Cursor's examples include internal dashboards, forms, portals and microsites; these are suggested uses, not evidence that any arbitrary prompt will produce a reliable production app.

A database is provisioned when the app needs one. Private and team apps sit behind Cursor sign-in. If a project connects to a maker's own system, Cursor asks for the required secrets through its app controls; the product docs say the agent does not see their values. A maker should still check what the app reads and writes, what credentials it receives and how those credentials can be revoked. A generated interface can look complete while an important permission or data path is wrong.

Who can open the published app?

Cursor lists three visibility choices: specific invited people, the signed-in team, or anyone with the link. On individual plans, apps can be shared publicly. For Teams and Enterprise, public sharing is disabled by default and requires an admin to turn it on. Cursor says the feature is available on paid plans with cloud-agent access. A team-only link is not a public launch simply because it has a URL. If a maker wants a broader audience, they should confirm the actual access setting in a signed-out browser before inviting people to try it.

What does Cursor check before publication?

The maker must explicitly press publish. Cursor says it blocks secrets and credential files, excludes .env files and source maps, and adds an AI security review for serious issues. If a check fails, publication pauses so the agent can fix the issue. Team admins can see apps and secrets and can unpublish an app. These controls help with common release mistakes; they do not establish that business logic, access rules, user data handling or every dependency is safe. A maker should test the finished app with the permissions and devices its intended users actually have.

For VIBPS, the interesting step comes after a working app has a public audience. VIBPS is the social network for software, where makers can publish an app they own and people can follow the creator. A private Cursor team tool may be valuable without belonging in a public feed. A publicly accessible app with a clear purpose, accurate images and a maker ready to respond to users has a different path: explain what it does, share it and keep improving it as people use it. Cursor's release makes hosting easier; it does not perform that audience work for the maker.

How to introduce your app clearly

More software stories, with sources and context.

More news