Why the email path needs a real check
Cursor’s agent is good at the code around authentication: forms, routes, token handling and email templates. But a change can pass every test and still send an email that links to localhost, never arrives because the sender isn’t set up, or contains a code that expires before anyone could type it. Those show up only when a real email reaches a real inbox.
Check it after every auth change
- Run the app locally, or open the preview deployment for your branch.
- Create an address in Proxy Mail QA, one per scenario: new user, invited user, password reset.
- Go through the flow the change touched, using the code or link from the address’s row.
- Read the whole email once in the inbox view: sender, subject, wording and every link.
- Note what you found on the address, so it stays with the test account.
Links to localhost on a preview or staging deployment are flagged on the row. Here’s how to fix them in Supabase, Firebase, Auth.js and other stacks.
Copy-paste prompts for Cursor
List every email this app sends: sign-up confirmation, magic link, password reset, invite and email change. For each, show where it's triggered in the code, which service sends it, how its link URL is built, and how long its code or link is valid. Flag hard-coded localhost URLs.
Build every link in auth emails from an environment variable for the app's public URL, with localhost only as the development default. Add the variable to .env.example and the deployment settings.
The email says the code is valid for 10 minutes. Make the server enforce the same expiry, and make requesting a new code invalidate the old one.
A project rule that prevents the usual bugs
Save this as a project rule (for example .cursor/rules/auth-emails.mdc) so the agent follows it whenever it touches auth:
When changing sign-up, login, password reset, invites or any email-sending code:
- Build links from the app's public URL setting, never a hard-coded localhost.
- Keep the expiry stated in an email equal to the one the server enforces.
- Make single-use links and codes stop working once used or replaced.
- Tell me which emails to test by hand after the change.