Fix prompts you can paste
Copy-paste prompts that fix real security problems in AI-built apps. Paste one into Cursor, Claude Code or your builder and it does the work.
Each one names the trap to avoid, so your AI does not "fix" the problem by turning the protection off — the most common way these go wrong.
3 minPrompt: turn on Supabase Row Level Security properlyEnables RLS everywhere and — importantly — catches the USING (true) policies that pass naive checks.3 minPrompt: get API keys out of your frontendFinds every hardcoded key, separates the public-by-design ones from the real secrets, and relocates the rest.3 minPrompt: actually protect your admin pagesTurns cosmetic role checks into enforcement that survives someone typing the URL directly.3 minPrompt: stop users reading each other's dataThe most common serious bug in AI-built apps: /orders/1041 works, and so does /orders/1042.3 minPrompt: fix open Firebase security rulesTest mode expires, and what replaces it is often a rule that allows everyone forever.3 minPrompt: add the security headers you are missingSix headers, no application changes, and a warning about the one that breaks sites.3 minPrompt: add rate limiting to your appWithout limits, your login is a password-guessing endpoint and your AI feature is someone else's free tier.3 minPrompt: move sessions out of localStorageA token in localStorage is readable by every script on the page, including one that got there by accident.3 minPrompt: stop shipping source maps to productionSource maps turn your minified bundle back into commented source. Anyone can download them.3 minPrompt: full checklist after a key leaksRotating the key is step one of five. The other four are where people stop too early.