The security prompt every vibe coder needs

You built a website with AI. It works. Nobody has checked if it is safe. This is the security check from the reel: 16 checks, done one by one, with fixes.

There are two ways to run it. On Claude, install the vibe-security skill: it works on a new branch, never prints your keys, and hands back a scoreboard. On Cursor, Lovable, Bolt or anything else, copy the prompt below.

Install the skill (Claude)

Claude Code: download vibe-security.zip, then run this and open Claude Code in your project folder.

mkdir -p ~/.claude/skills && unzip vibe-security.zip -d ~/.claude/skills/

Claude.ai: go to Settings, then Capabilities, then Skills, click Upload skill and pick the zip. Do not unzip it.

Then type:

Use the vibe-security skill on this project

The prompt (any AI tool)

You are doing a security pass on my vibe-coded website before real users touch it. I am not a security engineer, so explain everything in plain words.

Work through this list in order. For each item: (1) check the code, (2) tell me what you found and where, (3) fix it, (4) show me the change. If something needs a decision from me, stop and ask. Do not skip an item because it looks fine: prove it.

1. Hide my API keys. Find every key, token and secret in the code and move them to environment variables. Nothing secret in front-end code.
2. Keep my passwords off GitHub. Check the repo and its history for .env files, keys and passwords. Add them to .gitignore, and tell me which secrets I must rotate because they were already pushed.
3. Lock my admin page. Every admin page and admin API route needs a logged-in admin, checked on the server.
4. Add a proper login. Use a trusted auth library or provider, not hand-rolled auth, with secure session cookies.
5. Make sure users only see their own data. For every query and API route that returns or changes user data, check the logged-in user owns it.
6. Check every form for bad input. Validate and clean every input on the server, not only in the browser.
7. Stop bots from spamming my login. Rate limit login, signup and password reset.
8. Use HTTPS everywhere. Redirect HTTP to HTTPS and mark cookies as secure.
9. Hash my passwords. No plain-text passwords anywhere, including logs. Use a slow hash made for passwords.
10. Lock down the database. No public write access, access rules on every table, and the app connects with the fewest privileges it needs.
11. Back up my database every day. Set up automatic daily backups and show me how to restore one.
12. Turn off debug mode in production.
13. Hide error messages from users. Users see a friendly error; the details go to the server log.
14. Update old packages. List packages with known vulnerabilities and update them.
15. Delete code I'm not using. Remove unused routes, test endpoints, sample data and leftover files.
16. Run a full security check. Go through the whole project once more and list anything else risky, worst first.

When you are done, give me one table: item, what you found, what you changed, what I still have to do myself.

Make no mistakes.

How to use it

1. Open your project in the AI tool that can read your code (Claude Code, Cursor, Lovable, Bolt, Replit).
2. Paste the prompt and send it. Do this on a copy or a new branch, not on the live site.
3. Let it go item by item. When it says something "looks fine", ask it to show you the file and the line.
4. Do the things only you can do: change any key or password it found in your history, and switch on backups with your host.

What the 16 checks are for

1. Hide my API keys. Keys sitting in your code can be read by anyone who opens the page source or the repo.
2. Keep my passwords off GitHub. A secret that was pushed once stays in the history. It has to be changed, not just deleted.
3. Lock my admin page. Hiding the link is not a lock. The server has to check who is asking.
4. Add a proper login. Login is the one thing you should not let an AI invent from scratch.
5. Make sure users only see their own data. The classic vibe-coded bug: change an id in the URL and you are reading someone else's account.
6. Check every form for bad input. Every box a user can type in is a door.
7. Stop bots from spamming my login. Without a limit, a script can try passwords all night.
8. Use HTTPS everywhere. Without it, logins travel in the open.
9. Hash my passwords. If your database leaks, hashed passwords are scrambled. Plain ones are a list.
10. Lock down the database. Most leaks from AI-built apps are a database anyone could read or write.
11. Back up my database every day. A backup you have never restored is a guess.
12. Turn off debug mode. Debug mode shows visitors how your app works inside.
13. Hide error messages from users. Raw errors hand out table names and file paths.
14. Update old packages. Old packages have known holes with public instructions.
15. Delete code I'm not using. A forgotten test route is still a live route.
16. Run a full security check. One last pass for whatever the list missed.

Things to know

• This is a first pass, not a full security audit. It catches the common mistakes in AI-built apps.
• If you take payments or store health or money data, get a person to review it as well.
• Run it again after every big feature. New code brings new holes.

Questions

Does this prompt work in Cursor, Lovable or Bolt?
Yes. It is plain text. Paste it into any AI coding tool that can read and edit your project: Claude Code, Cursor, Lovable, Bolt, Replit or v0.

Is one prompt enough to make my app secure?
No. It is a first pass that catches the common mistakes in AI-built apps. If you take payments or store health or financial data, pay a person to review it too.

How long does it take?
On a small project the AI works through all 16 items in about 10 to 20 minutes. Rotating leaked keys and setting up backups are on you.