Jun 23 • Prompt Vault
FREE PROMPT PACK - Security | June 23rd
Copy and paste these prompts into Claude Code, Codex, Cursor, or any other coding agent. Run them one at a time, and test your app after each change.
1.Add a Content Security Policy
“Add a Content Security Policy to my app to limit the damage of cross-site scripting. Start by restricting script, style, and resource sources to trusted origins, eliminate or tightly control inline scripts, and set the policy via response headers on every page. Begin in report-only mode if needed to find violations without breaking the app, then enforce it, and explain the directives you chose and what they block.”
2.Remove revealing server response headers
“Review the HTTP response headers my app and server send and remove or genericize ones that reveal implementation details, such as server software names, framework identifiers, and version numbers. While you're there, confirm the recommended security headers are present and correctly configured. Make these changes at the application or server layer so they apply to all responses, and give me a before-and-after of the headers being sent.”
3.Validate and bound user regex
“Audit the codebase for regular-expression denial-of-service risks. Find regexes that run against user-controlled input, especially ones with nested or overlapping repetition that can backtrack catastrophically, and rewrite them into safe linear-time patterns or replace them with non-regex parsing. Add input length limits before regex evaluation and, where supported, a matching timeout, and tell me which patterns were dangerous and how you fixed them.”
4.Block server-side template injection
“Audit my server-side templating for template injection. Find any place where user-controlled input is concatenated into a template or passed where the engine will evaluate it as template syntax, and refactor so untrusted input is always supplied as data to a static template, never used to build the template itself. Confirm the engine's auto-escaping is enabled and that no user input can reach template evaluation, then report what you found.”
5.Prevent NoSQL query injection
“If my app uses a NoSQL database, audit it for injection where user input is placed directly into query objects or operators. Ensure inputs are validated and cast to expected types so an attacker cannot smuggle in query operators or expressions that alter the query's logic — for example turning a value into an object that always matches. Sanitize or reject unexpected structures in incoming data, and report each query you hardened.”
0
0 comments
FREE PROMPT PACK - Security | June 23rd
skool.com/a2b
Vibe-coded an app that's 80% complete? We teach you everything you need to know to make it secure, polished, and performant so YOU can finally launch.
Leaderboard (30-day)
1
+3
2
+1
3
+1
Powered by