10 Copy-Paste Security Prompts for Your AI Agent

How to use this post.

Each prompt has three parts. The question (your worry, in plain English). The goal (what success looks like when the prompt finishes). The directive (the exact block to paste at your agent).

Every directive lives in the Composed Security prompt-packs repo on GitHub, one file per prompt. Each card below links straight to its file and has a one-click copy button, so the post stays readable and you always paste the current version.

Open Cursor, Lovable, Bolt, or Claude Code. Pick the prompt that matches your worry. Copy the directive from GitHub, paste it at your agent, and let it work.

If you haven't read the field guide that explains why each of these matters, start with: You Vibe-Coded an App. Now Don't Get Pwned.

Prompt 1: Find every exposed secret in my code.

Question: are any of my API keys, tokens, or secrets sitting in my code where a bot can find them in under four minutes?

Goal: a complete inventory of every potential secret in the codebase, where it lives, whether it's safe, and the exact action to take for each one.

Prompt 2: Add Row Level Security to every Supabase table.

Question: can a stranger with my anon key read my entire database right now?

Goal: every table has RLS enabled with policies that match its real-world ownership model. Nothing breaks for legitimate users.

Prompt 3: Move every hardcoded secret into proper environment variables.

Question: are my secrets where they should be, in env vars, not in my code?

Goal: zero hardcoded secrets, a clean .env.local, a safe-to-commit .env.example, and a list of every var I need to set in my hosting dashboard.

Prompt 4: Scrub leaked secrets from git history permanently.

Question: I leaked a key to git. How do I make sure it's actually gone, from every commit, every fork, every CI cache?

Goal: the leaked secret is unrecoverable from anywhere I control, a new secret is in place, and I have a checklist for the places I might NOT control.

Prompt 5: Add rate limiting to every API route.

Question: can someone hammer my expensive endpoints and bankrupt me?

Goal: every API route has a rate limit appropriate to its cost class. Abuse returns a clean 429 with retry-after.

Prompt 6: Add input validation to every endpoint.

Question: is my app trusting whatever garbage a user sends it?

Goal: every endpoint validates input against a strict schema before any business logic runs. No raw req.body access anywhere.

Prompt 7: Audit my login flow for vulnerabilities.

Question: did my AI ship me an auth flow that someone can trivially break?

Goal: a complete report of every weakness in the auth flow, with file:line locations and the exact fix for each.

Prompt 8: Set up Stripe webhook signature verification.

Question: can someone fake a "this user paid" webhook to my app and unlock paid features for free?

Goal: every webhook endpoint verifies signatures. Stripe events get processed exactly once. Replay attacks fail.

Prompt 9: Find frontend-only access controls and move them to the backend.

Question: are any of my admin checks happening only in the browser, where anyone can flip a switch and walk in?

Goal: every authorization check has a backend equivalent. Frontend checks remain for UX only.

Prompt 10: Pre-flight security check before deployment.

Question: if I shipped this right now, would I show up in a horror story tomorrow?

Goal: a go/no-go report covering every category in this guide. Each item PASS / FAIL / N/A with file:line for every fail and a fix-or-acknowledge instruction.

After the prompts run.

If everything came back clean, you're ahead of most apps shipping right now. Most app's defenders run their first security check after a real customer reports a problem.

If something came back red, fix the CRITICAL findings first. Then HIGH. MEDIUM and LOW can wait until tomorrow. The goal isn't a perfect security report. It's closing the door on the breach classes that actually take apps down.

Set the calendar reminder. Every Monday: cost dashboards, auth provider logs, GitHub Secret Scanning alerts, deploy logs, Have I Been Pwned. Five minutes. The compounding effect of those five minutes is the difference between not being a horror story and being one.

The full set stays current in prompt-packs on GitHub. Star it to get new prompts as we publish them, and open a pull request if you have one that catches something real.