Jun 22 • Prompt Vault
FREE PROMPT PACK - App Security | June 22nd
Copy and paste these prompts into Claude Code, Codex, Cursor, or any other coding agent. Run them one at a time, and test your app after each change.
1.Verify Origin and Referer headers
“For sensitive state-changing endpoints, add server-side validation of the Origin and Referer headers as an additional defense. Confirm that requests to these endpoints originate from my own application's expected origins and reject those that don't, while handling the cases where these headers may legitimately be absent. Use this as a complement to, not a replacement for, token-based CSRF protection, and tell me which endpoints now perform this check.”
2.Audit dependencies for known vulnerabilities
“Scan my project's dependencies for known security vulnerabilities using the appropriate audit tool for my package ecosystem. Produce a list of vulnerable packages with their severity, identify which are exploitable in my app's context, and update or replace them to patched versions, taking care with breaking changes. Where no fix exists, suggest mitigations, and give me a prioritized summary of what was vulnerable and what you updated.”
3.Validate input on the server
“Audit my app to ensure all input validation is enforced on the server, not only in the browser. For every endpoint, validate that incoming data matches the expected type, shape, and constraints server-side, treating any client-side validation as a user-experience nicety rather than a security control. Find endpoints that trust client-validated input and add the missing server-side checks, then give me a list of the endpoints you hardened.”
4.Reject malformed and unexpected fields
“Make my app's request handling strict about unexpected and malformed input. Configure validation to reject requests containing unknown or extra fields rather than silently ignoring them, fail clearly on malformed JSON or bad encoding, and ensure parsing errors return a safe, generic error without leaking internals. This narrows what an attacker can smuggle in alongside valid data — report where you tightened parsing and what now gets rejected.”
5.Force HTTPS across the application
“Audit my app to ensure all traffic is served exclusively over HTTPS. Redirect any plain HTTP requests to HTTPS, confirm that cookies are flagged Secure so they're never sent unencrypted, and check that internal links, API calls, and third-party resources use HTTPS to avoid mixed content. Verify there are no endpoints reachable only over HTTP, and tell me what you changed to enforce encryption everywhere.”
3
2 comments
FREE PROMPT PACK - App Security | June 22nd
skool.com/a2b
Vibe-coded an app that's 80% complete? We teach you everything you need to know to make it secure, polished, and performant so YOU can finally launch.
Leaderboard (30-day)
1
+3
2
+1
3
+1
Powered by