Prompt library

Fix prompts you can paste

Copy-paste prompts that fix real security problems in AI-built apps. Paste one into Cursor, Claude Code or your builder and it does the work — including the traps to avoid.

Why a prompt instead of instructions

If you built your app by describing it to an AI, the fastest way to fix it is to describe the fix the same way. You do not need to understand Row Level Security to paste a prompt that turns it on correctly — but you do need the prompt to be written by someone who does.

That is the part these are for. Each one names the specific trap the AI would otherwise fall into, because the quickest way to make a security error go away is usually to remove the protection that produced it. Ask an assistant to fix "new row violates row-level security policy" without constraints and there is a fair chance it disables the policy. The prompt below that error forbids exactly that, in writing, before it forbids anything else.

How to use one

  1. 01Pick the prompt matching your problem. If you are not sure which, run the free check on the homepage — it names the problem for you.
  2. 02Copy it whole. The constraints at the bottom are load-bearing; a trimmed prompt is how you get a fix that silences the symptom.
  3. 03Paste it into Cursor, Claude Code, Lovable, Windsurf or whatever you build with.
  4. 04Read what it says it changed, then verify from outside using the check on the same page. An AI reporting success is not evidence.

Database access

The largest single cause of leaked user data in AI-built apps. The browser talks to the database directly, so the database is the only thing that can decide who reads what.

3 minPrompt: turn on Supabase Row Level Security properlyEnables RLS everywhere and — importantly — catches the USING (true) policies that pass naive checks.3 minPrompt: fix open Firebase security rulesTest mode expires, and what replaces it is often a rule that allows everyone forever.

Secrets and keys

AI tools put the key where the code that needs it lives. When that code runs in the browser, so does the key — and deployed JavaScript is scraped continuously.

3 minPrompt: get API keys out of your frontendFinds every hardcoded key, separates the public-by-design ones from the real secrets, and relocates the rest.3 minPrompt: full checklist after a key leaksRotating the key is step one of five. The other four are where people stop too early.3 minPrompt: stop shipping source maps to productionSource maps turn your minified bundle back into commented source. Anyone can download them.

Who is allowed in

Hiding a page from the menu is not access control, and being signed in is not the same as being allowed. These move enforcement to the server, where the visitor cannot edit it.

3 minPrompt: actually protect your admin pagesTurns cosmetic role checks into enforcement that survives someone typing the URL directly.3 minPrompt: stop users reading each other's dataThe most common serious bug in AI-built apps: /orders/1041 works, and so does /orders/1042.

Sessions and abuse

Where the session lives decides how bad one injected script gets, and whether anything stops the same request arriving ten thousand times.

3 minPrompt: move sessions out of localStorageA token in localStorage is readable by every script on the page, including one that got there by accident.3 minPrompt: add rate limiting to your appWithout limits, your login is a password-guessing endpoint and your AI feature is someone else's free tier.

Browser-level protection

The cheapest protection available: no application changes, and it turns several classes of bug from serious into harmless.

3 minPrompt: add the security headers you are missingSix headers, no application changes, and a warning about the one that breaks sites.

Where to go next

Security checksRun them against your own site before and after.Errors explainedWhat the message means, and when it means you are safe.Lovable securityThe six gaps that builder leaves behind.A key already leakedRotate first. Start here.

Not sure which one you need?

Run the free check on your live site. It names the problems it finds and hands you the matching prompt, already filled in. About 30 seconds, no signup.

Check my site — free