← All incidents

Enrichlead: a SaaS built with 'zero hand-written code' in Cursor was abused within days and shut down

Incident · Cursor · HIGH

Summary

Founder Leo Acevedo posted that his sales-lead SaaS, Enrichlead, was built with Cursor and 'zero hand written code'. Days later he wrote that he was 'under attack': API key usage maxed out, people bypassing the subscription and writing junk into the database. He rotated keys, added auth and tightened CORS, then said he was shutting the app down.

Severity

Timeline

1. Mar 2025
   Acevedo posts that the app was built entirely with Cursor.
2. Mar 17, 2025, 09:04 UTC
   'guys, i'm under attack' post.
3. Mar 17, 2025, 11:38 and 15:18 UTC
   In replies he says he rolled all API keys and moved them to environment variables, added authentication to API endpoints and limited CORS to trusted domains.
4. Mar 20, 2025, 01:48 UTC
   He posts that he is shutting the app down: 'I shouldn't have deployed unsecured code to production'.

How it happened

By the founder's own account in the thread, API keys had to be moved out of the code into environment variables, and the API endpoints had no authentication until he added it. That let outsiders run up his API bills, use paid features without paying and write to the database. He also said fixes made with Cursor kept breaking other parts of the code. Note: some later write-ups list more failures; we only include what the founder himself posted.

How to check your app

• Search your built front-end bundle for API keys (sk-, pk_live, service_role, AIza). Anything there is public.
• Call each API endpoint with no session. Paid or write actions must be refused.
• Enforce subscriptions on the server, not by hiding buttons in the UI.
• Set spending caps and alerts on every third-party API key.

Sources

• Founder's 'under attack' post on X
• Founder's reply listing the first fixes
• Founder's shutdown post on X
• Founder's post, archived (archive.today)
• Thread with the fixes he made (unroll)
• Pivot to AI write-up with the shutdown post

Corrections and updates

1. Oct 14, 2026
   Added the founder's original posts on X as sources and checked the timeline against them. The shutdown post is dated Mar 20, 2025 (UTC).