-
Secure Accounts Essentials Pack
Lock down auth, secrets, and headers so user accounts stay safe from day one.
Prompts In This Pack
-
Security
Add two-factor authentication to my app
Implements TOTP-based 2FA with recovery codes and clean enrollment, without locking existing users out.
-
Security
Lock down my admin routes and features
Verifies admin pages, endpoints, and seeded admin accounts are protected by role checks and not default credentials.
-
Security
Audit my auth flow for common vulnerabilities
Reviews your login, signup, and session handling for issues like missing rate limiting, weak token storage, and unprotected routes.
-
Security
Audit my JWT signing and validation
Verifies tokens are signed with strong secrets, validated on every request, and expire sensibly.
-
Security
Trim my OAuth scopes and token storage
Reviews every OAuth provider integration for overly broad scopes and unsafe token storage, then tightens both.
-
Security
Audit my password reset flow for takeover risks
Reviews token generation, expiration, and single-use handling in your reset flow so attackers can't hijack accounts through it.
-
Security
Encrypt sensitive fields at rest
Identifies fields holding sensitive personal data and adds application-level encryption where hashing won't work.
-
Security
Verify passwords are hashed correctly
Confirms passwords are hashed with bcrypt or argon2, never stored in plaintext, and never logged.
-
Security
Set a sane password policy
Enforces minimum length and breached-password checks without arbitrary complexity rules that push users to weak patterns.
-
Security
Enforce security headers site-wide
Adds CSP, HSTS, X-Frame-Options, and other security headers with a report-only rollout before enforcing.
-
Security
Find and fix exposed environment variables
Scans your client-side code for API keys and secrets that should live on the server, then moves them behind a safe API layer.
-
Security
Fix IDOR: check ownership on every object access
Finds endpoints where changing an ID in the URL or body exposes other users' data, and adds ownership checks.
-
Security
Add session expiration and rotation
Makes sessions expire, rotate after login and privilege changes, and die on logout on the server side.
-
Security
Log the security events that matter
Adds audit logging for logins, failures, permission changes, and sensitive actions without logging secrets.
-
Security
Stop leaking which emails have accounts
Makes login, signup, and reset responses identical whether an email exists or not.
-
Security
Enforce auth checks on the server, not just the UI
Finds routes and API endpoints that rely on hidden UI for protection and adds real server-side authorization.
-
Security
Rate limit my login and signup endpoints
Adds per-IP and per-account throttling with clear responses so credential stuffing and brute force stall out.
-
Security
Remove hardcoded secrets from my codebase
Finds API keys and passwords committed in source, moves them to environment variables, and tells you which ones to rotate.
-
Security
Kill other sessions when the password changes
Invalidates all existing sessions after a password change or reset, so stolen sessions die with the old password.
-
Security
Secure my account deletion flow
Requires re-authentication for deletion, actually deletes the data, and confirms what happens to backups and third parties.
-
Security
Protect file downloads with authorization checks
Makes private files (invoices, documents, exports) require ownership checks or short-lived signed URLs instead of guessable public links.
-
Security
Harden my magic link login
Makes email login links single-use, short-lived, and bound to the browser that requested them.
-
Security
Audit my OAuth login flow
Verifies state parameters, redirect URI matching, and token handling in Google/GitHub-style social login.
-
Security
Secure my password change flow
Requires the current password to change it, sends a notification email, and rate limits attempts.
-
Security
Lock down my session cookie flags
Sets HttpOnly, Secure, and SameSite on session cookies and fixes session tokens stored in localStorage.
-
Testing
Test the links and tokens inside my emails
Verify every link in every transactional email resolves correctly and every token does what it should, once.
-
Testing
Test every endpoint against every user role
Build a permissions matrix test proving users can only do and see what their role allows.
-
Security
Verify email ownership before activating accounts
Adds verification emails with expiring tokens and limits what unverified accounts can do.
Want to skip doing this by hand?
Fortivibe audits your app for all of the areas these prompts cover (and more).
More Prompt Packs
-
Launch-Ready Security Pack
Auth, secrets, injection, and headers. Everything you need to harden before launch.
-
Ship Fast Starter Pack
Deployment, caching, and automation prompts to get your app live with confidence.
-
Data Layer Defense Pack
Injection-proof queries, safe secrets handling, and schema guardrails for your database.
-
Payment Protection Pack
Webhooks, idempotency, refunds, and dunning. Stop payments issues before they start.
-
Test Before You Launch Pack
Unit, API, and end-to-end tests for the paths your users will actually hit on day one.
-
Speed Rescue Pack
Find and fix the slow queries, missing indexes, and heavy pages dragging your app down.