Would love to know your thoughts here!

Copy and paste these prompts into Claude Code, Codex, Cursor, or any other coding agent. Run them one at a time, and test your app after each change. 1.Block operating system command injection Search the codebase for any place where the app runs operating-system commands, shell scripts, or external processes, and check whether user-controlled input can influence them. Eliminate command injection by avoiding the shell entirely where possible, passing arguments as a structured array rather than a concatenated string, and strictly validating any input that must be included. If a piece of functionality doesn't truly need to shell out, refactor it, and report every command-execution site you found. 2.Replace weak cryptographic algorithms Scan the codebase for weak or outdated cryptography and replace it. Find uses of broken hash functions like MD5 or SHA1, weak ciphers like DES, insecure modes like ECB, hardcoded encryption keys or initialization vectors, and homegrown crypto, and replace each with a current, well-vetted algorithm and a standard library implementation. Confirm that hashing for passwords specifically uses a slow algorithm, and report every weak primitive you found and what you replaced it with. 3.Verify signatures on incoming webhooks Audit any webhook endpoints my app exposes to receive events from third-party services. For each, verify the authenticity of incoming requests using the provider's signature mechanism — validating the signature against the raw request body with the shared secret and a constant-time comparison — and reject anything that fails. Add protection against replayed events using timestamps or event identifiers, and tell me which webhooks now verify their senders. 4.Cap request body and payload size Add limits on the size of incoming requests across my app. Configure maximum request body sizes at the server or framework level, cap the size of uploaded files and individual fields, and limit the number of items in arrays and the depth of nested JSON so a malicious payload can't exhaust memory or CPU. Return a clear error when a limit is exceeded, and tell me the limits you set and where they're enforced.

Someone in the Skool community made a great recommendation: "why don't you make a series actually vibecoding an app front to back?" I think that's awesome, but I want to go one step further: I want whatever I create to be valuable for you all in your journey so I can publish it and give everyone access for free. This could be a tool, a resource - really anything. What would be valuable to you?

Copy and paste these prompts into Claude Code, Codex, Cursor, or any other coding agent. Run them one at a time, and test your app after each change. 1.Inline tiny critical SVGs and icons Find small, critical SVG icons and graphics that are loaded as separate network requests on important pages. Inline the few that appear above the fold directly into the markup or a sprite so they render without extra round trips, while keeping larger or rarely-used graphics external. Avoid inlining large SVGs that would bloat the HTML. Verify the critical icons appear instantly with fewer requests. 2.Use database connection pooling Check whether my app opens a fresh database connection per request or operation instead of reusing a pool. Configure a properly sized connection pool so connections are reused, with limits tuned to the database's capacity and the app's concurrency. In serverless or high-fan-out setups, ensure pooling works correctly (e.g., via a pooler). Verify connection overhead drops and the database isn't overwhelmed by connection churn under load. 3.Add an in-memory cache layer Identify frequently accessed, slow-to-fetch data that would benefit from a fast in-memory cache (such as Redis or an in-process cache for single instances). Introduce the cache layer for those reads with clear keys, TTLs, and a safe miss-and-populate path, falling back to the source on cache failure. Be mindful of consistency across multiple server instances. Verify the cached reads are dramatically faster and source-system load drops. 4.Add a client-side request cache Review how my client refetches data when users revisit screens or navigate back and forth, and find cases where it re-requests identical data unnecessarily. Introduce a client-side cache (or adopt a data-fetching library that provides one) keyed by request parameters, with sensible freshness and invalidation rules. Ensure mutations correctly invalidate affected cache entries. Verify revisiting screens reuses cached data and avoids redundant requests.

Copy and paste these prompts into Claude Code, Codex, Cursor, or any other coding agent. Run them one at a time, and test your app after each change. 1.Verify Origin and Referer headers “For sensitive state-changing endpoints, add server-side validation of the Origin and Referer headers as an additional defense. Confirm that requests to these endpoints originate from my own application's expected origins and reject those that don't, while handling the cases where these headers may legitimately be absent. Use this as a complement to, not a replacement for, token-based CSRF protection, and tell me which endpoints now perform this check.” 2.Audit dependencies for known vulnerabilities “Scan my project's dependencies for known security vulnerabilities using the appropriate audit tool for my package ecosystem. Produce a list of vulnerable packages with their severity, identify which are exploitable in my app's context, and update or replace them to patched versions, taking care with breaking changes. Where no fix exists, suggest mitigations, and give me a prioritized summary of what was vulnerable and what you updated.” 3.Validate input on the server “Audit my app to ensure all input validation is enforced on the server, not only in the browser. For every endpoint, validate that incoming data matches the expected type, shape, and constraints server-side, treating any client-side validation as a user-experience nicety rather than a security control. Find endpoints that trust client-validated input and add the missing server-side checks, then give me a list of the endpoints you hardened.” 4.Reject malformed and unexpected fields “Make my app's request handling strict about unexpected and malformed input. Configure validation to reject requests containing unknown or extra fields rather than silently ignoring them, fail clearly on malformed JSON or bad encoding, and ensure parsing errors return a safe, generic error without leaking internals. This narrows what an attacker can smuggle in alongside valid data — report where you tightened parsing and what now gets rejected.”