diff --git a/src/web-server/routes/cursor-routes.ts b/src/web-server/routes/cursor-routes.ts
index 65591d6a..281d1490 100644
--- a/src/web-server/routes/cursor-routes.ts
+++ b/src/web-server/routes/cursor-routes.ts
@@ -121,15 +121,15 @@ router.post('/auth/auto-detect', async (_req: Request, res: Response): Promise<v
   try {
     const result = autoDetectTokens();
 
-    if (!result.found) {
-      res.status(404).json({ error: result.error });
+    if (!result.found || !result.accessToken || !result.machineId) {
+      res.status(404).json({ error: result.error ?? 'Token not found' });
       return;
     }
 
     // Save credentials
     saveCredentials({
-      accessToken: result.accessToken!,
-      machineId: result.machineId!,
+      accessToken: result.accessToken,
+      machineId: result.machineId,
       authMethod: 'auto-detect',
       importedAt: new Date().toISOString(),
     });
diff --git a/src/web-server/routes/cursor-settings-routes.ts b/src/web-server/routes/cursor-settings-routes.ts
index 608512fc..ef5dac6d 100644
--- a/src/web-server/routes/cursor-settings-routes.ts
+++ b/src/web-server/routes/cursor-settings-routes.ts
@@ -34,9 +34,15 @@ router.put('/', (req: Request, res: Response): void => {
 
     // Validate input types
     if (updates && typeof updates === 'object') {
-      if ('port' in updates && typeof updates.port !== 'number') {
-        res.status(400).json({ error: 'port must be a number' });
-        return;
+      if ('port' in updates) {
+        if (typeof updates.port !== 'number' || !Number.isInteger(updates.port)) {
+          res.status(400).json({ error: 'port must be an integer' });
+          return;
+        }
+        if (updates.port < 1 || updates.port > 65535) {
+          res.status(400).json({ error: 'port must be between 1 and 65535' });
+          return;
+        }
       }
       if ('auto_start' in updates && typeof updates.auto_start !== 'boolean') {
         res.status(400).json({ error: 'auto_start must be a boolean' });