Vibecoders don't know shit about security. These 5 prompts fix that.
Secrets, auth, database rules, user input, and the cost bomb nobody warns you about. Five prompts, one per attack surface, run before you ship.
You vibecoded an app that works. It signs people up, it takes their data, maybe it takes their money. The model that built it optimized for working, and nobody asked it about safe.
The good news is the same model will find its own mistakes if you point it at them with the right words. Below are five prompts, one per attack surface. Open Claude Code at the root of your project, run them in order, and fix the CRITICALs before you touch anything else.
1. The secrets sweep
Bots scrape GitHub for leaked keys within minutes of a push, and deleting the file later saves you nothing because git keeps the history. This prompt hunts hardcoded keys, committed .env files, and secrets buried in old commits. Then it tells you which keys to rotate, because a key that ever touched a public file is burned no matter where you hide it now.
Act as a security researcher auditing my repo for exposed secrets. Find:
1. Hardcoded API keys, tokens, passwords, or connection strings in any file
2. .env files that are committed or missing from .gitignore
3. Secrets in git history even if the file was deleted later
4. Secrets that ship to the browser in frontend code or build output
5. Public/anon keys doing privileged work
Output a table: file and line | what leaked | how an attacker finds it |
severity (CRITICAL / HIGH / MEDIUM) | exact fix.
Then list every key I need to rotate. A key that ever touched a commit is
burned, hiding it now is not enough.2. The auth teardown
Your login page is a door. This prompt checks whether the walls around it exist: routes that skip the session check, tokens that never expire, password rules you left off, reset flows that let a stranger claim someone else's account. The finding that shows up in almost every vibecoded app: an endpoint that trusts the user ID sent in the request instead of the one on the session.
Attack my authentication like you want in. Walk every auth path in this repo:
1. List every route and API endpoint and whether it verifies a valid session.
Flag any that skip it.
2. Session handling: where tokens live, whether they expire, whether logout and
password change kill them
3. Password rules: minimum length, breached-password check, anything my auth
provider offers that I left off
4. Password reset and email verification: can I reset someone else's password,
or use the app with an unverified email?
Output: flow | weakness | exact exploit steps | severity | fix.
Any endpoint that trusts a user ID from the request body instead of the session
is CRITICAL.3. The database interrogation
On Supabase, your anon key ships to every visitor's browser. Row level security is the only thing standing between that key and your entire users table. This prompt goes table by table and writes the exact query an attacker would run to read someone else's rows, so you see the leak instead of taking a policy's word for it.
Audit my database access rules table by table (Supabase RLS or equivalent).
1. List every table and whether RLS is enabled. Any table reachable with the
public key and no RLS is CRITICAL.
2. For each policy, write the exact query user A runs to read or edit user B's
rows, and tell me whether it works.
3. Flag policies that filter on values the client sends instead of auth.uid().
4. Check INSERT and UPDATE policies, not just SELECT: can I insert rows pointed
at another user, or update columns I shouldn't own, like role or credits?
5. Apply the same checks to storage buckets.
Output: table | policy state | the attack query | what leaks | severity |
corrected policy as real SQL.4. The input audit
Every text box on your app is a place where a stranger types instructions to your server. Unsanitized, that input closes your SQL quote and appends its own query, or plants a script that runs in every other visitor's browser, or uploads a file your server ends up executing. This prompt traces each path from input to something dangerous.
Trace every path where user input reaches something dangerous in this repo:
1. SQL or NoSQL queries built with string concatenation or template literals
instead of parameters
2. Input passed to eval, exec, child_process, or shell commands
3. File uploads: is the filename sanitized, is the type verified server-side,
can I upload an executable or path-traverse with ../
4. User content rendered as HTML without escaping, including
dangerouslySetInnerHTML and markdown renderers
5. Endpoints with no server-side validation at all
Output: file and line | input source | what it reaches | a working example
payload | severity | fix.5. The cost bomb check
Your app has routes that cost you money every time they run, and your AI endpoints are the worst offenders. No rate limit means one script, one night, and a four-figure bill on your card before you wake up. This prompt finds every route that spends your money and asks what stops a bot from hammering it.
Find every endpoint in this app that costs me money or resources when called,
and check its protection:
1. Routes that trigger AI or LLM API calls: what stops a script from calling
each one 100,000 times tonight? Check auth, per-user limits, per-IP limits.
2. Login, signup, and password reset: rate limits, bot protection, and whether
response differences let someone enumerate valid emails
3. Email or SMS sending routes someone can spam through
4. Expensive queries or exports with no caps or pagination
5. Usage metering: is it enforced server-side, and does it fail closed?
Output: endpoint | what one call costs me | the abuse scenario | projected
damage from one night | severity | the exact limiter to add.How to run this
- 1.Open Claude Code (or Cursor) at the root of your project.
- 2.Run the prompts in order, one at a time. Each produces a findings table.
- 3.Fix every CRITICAL before moving to the next prompt.
- 4.Re-run the prompt after your fixes and make it confirm the hole is closed.
- 5.Repeat the full pass after every big feature, because new code ships new holes.
One warning: these prompts produce findings, and the first run on a real app usually produces a lot of them. That feeling in your stomach is the point. Better you find them on a Tuesday than a stranger finds them on launch day.
Run all five before every ship. It takes twenty minutes. A real audit costs five grand and this one costs you a lunch break.
