-
Launch-Ready Security Pack
Auth, secrets, injection, and headers. Everything you need to harden before launch.
Prompts In This Pack
-
Security
Add CSRF protection to my forms and mutations
Adds anti-CSRF tokens or SameSite defenses to every state-changing form and endpoint.
-
Security
Add rate limiting to my public endpoints
Protects login, signup, and API routes from brute force and abuse with sensible limits and lockout responses.
-
Security
Add request body size limits
Caps payload sizes on every endpoint so huge requests can't exhaust memory or disk.
-
Security
Lock down my admin routes and features
Verifies admin pages, endpoints, and seeded admin accounts are protected by role checks and not default credentials.
-
Security
Audit my auth flow for common vulnerabilities
Reviews your login, signup, and session handling for issues like missing rate limiting, weak token storage, and unprotected routes.
-
Security
Strip sensitive fields from my API responses
Finds endpoints returning entire database records and cuts responses down to the fields the client actually needs.
-
Security
Audit my database's public access rules
Checks Supabase row-level security, Firebase rules, and client-exposed databases for tables anyone can read or write.
-
Security
Audit my dependencies for known vulnerabilities
Runs the package audit, triages real risk from noise, and upgrades or replaces vulnerable packages safely.
-
Security
Check my repo for committed secrets and env files
Verifies .env and credential files are gitignored, searches git history for past commits, and plans rotation.
-
Security
Audit my JWT signing and validation
Verifies tokens are signed with strong secrets, validated on every request, and expire sensibly.
-
Security
Audit my password reset flow for takeover risks
Reviews token generation, expiration, and single-use handling in your reset flow so attackers can't hijack accounts through it.
-
Testing
Get real user data out of my test and staging environments
Finds production data copied into test fixtures and staging databases and replaces it with safe synthetic data.
-
Security
Stop bot signups and form spam
Adds layered bot resistance to public forms without punishing real users.
-
Security
Audit my third-party scripts and CDN assets
Inventories every external script, pins versions, adds integrity hashes where possible, and removes what's unused.
-
Database
Choose a safe ID strategy for records
Moves public-facing identifiers to unguessable IDs while keeping efficient internal keys, ending enumerable resource URLs.
-
Security
Turn off debug mode and dev tools in production
Finds debug flags, verbose error pages, and development-only routes that are still on in the production build and disables them.
-
Security
Enforce HTTPS everywhere
Redirects HTTP to HTTPS, enables HSTS, and removes mixed-content and insecure links.
-
Security
Verify passwords are hashed correctly
Confirms passwords are hashed with bcrypt or argon2, never stored in plaintext, and never logged.
-
Payments
Enforce plan limits on the server, not the UI
Moves feature gating and usage limits out of the frontend and into server-side checks on every protected action.
-
Security
Enforce security headers site-wide
Adds CSP, HSTS, X-Frame-Options, and other security headers with a report-only rollout before enforcing.
-
Database
Make sure tenants can't see each other's data
Audits every query in a multi-tenant app to confirm it is scoped by tenant or organization ID, and adds the missing filters.
-
Security
Find and fix exposed environment variables
Scans your client-side code for API keys and secrets that should live on the server, then moves them behind a safe API layer.
-
Security
Fix IDOR: check ownership on every object access
Finds endpoints where changing an ID in the URL or body exposes other users' data, and adds ownership checks.
-
Database
Harden my database queries against injection
Refactors string-interpolated queries into parameterized statements and adds input validation at the boundary.
-
Security
Stop leaking stack traces and internals in production
Replaces detailed error output with safe generic messages while keeping full detail in server logs.
-
Deployment
Get my secrets out of the repo and into a real secret store
Audit for leaked credentials and set up proper secret storage, rotation, and per-environment separation.
-
Payments
Keep card data out of my servers (PCI scope)
Confirms card numbers only ever touch the provider's fields and that your systems store nothing PCI-regulated.
-
Database
Audit my database network exposure and TLS
Confirms the database isn't reachable from the public internet and that connections use TLS with verified certificates.
-
Security
Pin my dependencies and commit the lockfile
Makes builds reproducible with exact versions, a committed lockfile, and no surprise auto-upgrades.
-
Security
Prevent command injection in shell calls
Finds every place user input reaches a shell command and replaces string interpolation with safe argument arrays.
-
Security
Fix DOM-based XSS in my frontend
Traces user-controlled data into innerHTML, document.write, and other DOM sinks and replaces them with safe alternatives.
-
Security
Prevent mass assignment on my update endpoints
Stops endpoints from writing whatever fields the client sends, so users can't grant themselves admin or change prices.
-
Security
Prevent NoSQL injection in my queries
Stops query operator injection by validating input types and stripping $-prefixed keys before they reach the database.
-
Security
Fix open redirects in my app
Audits every redirect that takes a URL from user input and restricts them to safe relative paths.
-
Security
Prevent path traversal in file operations
Stops ../ sequences in filenames and paths from reading or writing files outside the intended directory.
-
Security
Protect my app from prototype pollution
Finds every place untrusted JSON gets merged into objects and blocks __proto__ and constructor keys from poisoning the prototype chain.
-
Security
Prevent SSRF in features that fetch URLs
Validates and restricts any server-side fetching of user-supplied URLs so internal services stay unreachable.
-
Security
Prevent stored XSS in user-generated content
Escapes or sanitizes user content at render time and audits every place raw HTML is injected into the page.
-
Security
Enforce auth checks on the server, not just the UI
Finds routes and API endpoints that rely on hidden UI for protection and adds real server-side authorization.
-
Security
Rate limit my login and signup endpoints
Adds per-IP and per-account throttling with clear responses so credential stuffing and brute force stall out.
-
Security
Remove hardcoded secrets from my codebase
Finds API keys and passwords committed in source, moves them to environment variables, and tells you which ones to rotate.
-
Security
Restrict my app's database user permissions
Splits the app's database credentials away from superuser access and scopes them to what the app actually needs.
-
Deployment
Rotate my production secrets safely
Walks through rotating every API key, database credential, and signing secret with zero downtime, and sets a rotation cadence.
-
Security
Fix my CORS configuration
Replaces wildcard CORS with an explicit origin allowlist and correct credential handling.
-
Security
Protect file downloads with authorization checks
Makes private files (invoices, documents, exports) require ownership checks or short-lived signed URLs instead of guessable public links.
-
Security
Secure my file upload handling
Validates file types by content not extension, caps sizes, renames uploads, and keeps them outside the web root.
-
Security
Lock down my GraphQL API before launch
Disables introspection in production, adds query depth and cost limits, and checks field-level authorization across the schema.
-
Security
Lock down my session cookie flags
Sets HttpOnly, Secure, and SameSite on session cookies and fixes session tokens stored in localStorage.
-
Security
Authenticate and authorize my WebSocket connections
Adds auth to socket handshakes, per-channel authorization, and rate limiting to real-time features.
-
Payments
Set up basic payment fraud protection
Configures Stripe Radar rules and app-level checks to block card testers and obvious fraud before launch.
-
Deployment
Set HTTP security headers on every response
Turn on the free browser-level protections your app is probably shipping without.
-
Testing
Test my auth edge cases before attackers do
Cover session expiry, token reuse, logout behavior, and password reset abuse in your test suite.
-
Testing
Test my file upload handling for abuse cases
Verify uploads reject oversized files, wrong types, and hostile filenames before users find the holes.
-
Testing
Test that my forms validate on the server, not just the client
Prove every form's validation holds when the client-side checks are bypassed entirely.
-
Testing
Test every endpoint against every user role
Build a permissions matrix test proving users can only do and see what their role allows.
-
Testing
Test that my rate limiting actually limits
Verify rate limits trigger at the right thresholds, return correct responses, and reset when they should.
-
Testing
Test that my search and filters return the right results
Verify search queries, filters, and sorting return correct data, respect permissions, and don't leak other users' records.
-
Security
Validate Content-Type on my API endpoints
Rejects requests with unexpected content types so parsers and handlers only process what they were built for.
-
Security
Validate and sanitize all user input
Adds schema validation and sanitization at every input boundary to block malformed and malicious data.
-
Security
Verify incoming webhooks are genuine
Adds signature verification to every inbound webhook so forged events can't trigger actions.
Want to skip doing this by hand?
Fortivibe audits your app for all of the areas these prompts cover (and more).
More Prompt Packs
-
Ship Fast Starter Pack
Deployment, caching, and automation prompts to get your app live with confidence.
-
Secure Accounts Essentials Pack
Lock down auth, secrets, and headers so user accounts stay safe from day one.
-
Data Layer Defense Pack
Injection-proof queries, safe secrets handling, and schema guardrails for your database.
-
Payment Protection Pack
Webhooks, idempotency, refunds, and dunning. Stop payments issues before they start.
-
Test Before You Launch Pack
Unit, API, and end-to-end tests for the paths your users will actually hit on day one.
-
Speed Rescue Pack
Find and fix the slow queries, missing indexes, and heavy pages dragging your app down.