← Blog

Add a signup form with Cursor without leaking secrets

Use Cursor to add a real signup form with a public campaign id, a hosted endpoint, and a review checklist that keeps secrets out.

To add a working signup form with Cursor, give it a real endpoint, your public campaign id, and one hard rule: no secrets in front-end code. Cursor is excellent at scaffolding the markup and UX — you just supply the target so the action points somewhere that actually stores the email and blocks spam.

The prompt

Paste this, then swap the placeholder id for your real pub_... id. The public id is safe in browser code; an ss_live_ key never is.

Prompt for Cursor
Add a newsletter signup form to this project that POSTs to Simple Signups.


- Endpoint: https://simple-signups.com/api/subscribe
  (or path-style https://simple-signups.com/c/pub_your_campaign_id)
- Use my public campaign id pub_your_campaign_id (I will replace it with my real pub_... id).
- Include email (required) and a hidden honeypot field name="hp" (empty for humans).
- NEVER put ss_live_ keys, secrets, or tokens in browser code or commits.
- Do not remove the honeypot, rate limits, Turnstile, or domain checks.
- Prefer a plain HTML form; optional small fetch() JSON submit with the same fields.

What vague prompts get wrong

  • They invent a fake campaign id instead of leaving a clear placeholder.
  • They point the form at a local or same-origin API route you never needed.
  • They omit the hidden honeypot field or remove it during cleanup.
  • They drift into secrets in front-end code if you do not forbid that explicitly.

What you should get back

A plain HTML form (optionally enhanced with fetch) that posts email plus a hidden honeypot to your campaign endpoint — no API route, no secrets. Review it against the quickstart and allow-list each hostname you embed from.

Expected output (agent-generated)
<form action="https://simple-signups.com/api/subscribe" method="POST">
  <input type="hidden" name="campaignId" value="pub_your_campaign_id" />
  <input type="email" name="email" required placeholder="you@example.com" />
  <input type="text" name="hp" tabindex="-1" autocomplete="off"
    style="position:absolute;left:-9999px" aria-hidden="true" />
  <button type="submit">Subscribe</button>
</form>

Review checklist before you accept the diff

  • The action or fetch target is the real endpoint, not a placeholder route.
  • The campaign id is public (pub_...) and clearly marked for replacement.
  • The hidden hp field is still present.
  • No ss_live_ key, token, or dashboard secret appears in client code or commit text.

Related