Install these into Claude Code and have it autonomously check and fix over 300 potential issues in your codebase across UI design, performance, and security - perfect for an overnight polish pass. To set this up, download the .zip file, extract it, and read through HOW-TO-INSTALL.md (or, just have Claude read it and it can do it for you, haha) Hope this is helpful!

Copy and paste these prompts into Claude Code, Codex, Cursor, or any other coding agent. Run them one at a time, and test your app after each change. 1.Block operating system command injection Search the codebase for any place where the app runs operating-system commands, shell scripts, or external processes, and check whether user-controlled input can influence them. Eliminate command injection by avoiding the shell entirely where possible, passing arguments as a structured array rather than a concatenated string, and strictly validating any input that must be included. If a piece of functionality doesn't truly need to shell out, refactor it, and report every command-execution site you found. 2.Replace weak cryptographic algorithms Scan the codebase for weak or outdated cryptography and replace it. Find uses of broken hash functions like MD5 or SHA1, weak ciphers like DES, insecure modes like ECB, hardcoded encryption keys or initialization vectors, and homegrown crypto, and replace each with a current, well-vetted algorithm and a standard library implementation. Confirm that hashing for passwords specifically uses a slow algorithm, and report every weak primitive you found and what you replaced it with. 3.Verify signatures on incoming webhooks Audit any webhook endpoints my app exposes to receive events from third-party services. For each, verify the authenticity of incoming requests using the provider's signature mechanism — validating the signature against the raw request body with the shared secret and a constant-time comparison — and reject anything that fails. Add protection against replayed events using timestamps or event identifiers, and tell me which webhooks now verify their senders. 4.Cap request body and payload size Add limits on the size of incoming requests across my app. Configure maximum request body sizes at the server or framework level, cap the size of uploaded files and individual fields, and limit the number of items in arrays and the depth of nested JSON so a malicious payload can't exhaust memory or CPU. Return a clear error when a limit is exceeded, and tell me the limits you set and where they're enforced.

Copy and paste these prompts into Claude Code, Codex, Cursor, or any other coding agent. Run them one at a time, and test your app after each change. 1.Inline tiny critical SVGs and icons Find small, critical SVG icons and graphics that are loaded as separate network requests on important pages. Inline the few that appear above the fold directly into the markup or a sprite so they render without extra round trips, while keeping larger or rarely-used graphics external. Avoid inlining large SVGs that would bloat the HTML. Verify the critical icons appear instantly with fewer requests. 2.Use database connection pooling Check whether my app opens a fresh database connection per request or operation instead of reusing a pool. Configure a properly sized connection pool so connections are reused, with limits tuned to the database's capacity and the app's concurrency. In serverless or high-fan-out setups, ensure pooling works correctly (e.g., via a pooler). Verify connection overhead drops and the database isn't overwhelmed by connection churn under load. 3.Add an in-memory cache layer Identify frequently accessed, slow-to-fetch data that would benefit from a fast in-memory cache (such as Redis or an in-process cache for single instances). Introduce the cache layer for those reads with clear keys, TTLs, and a safe miss-and-populate path, falling back to the source on cache failure. Be mindful of consistency across multiple server instances. Verify the cached reads are dramatically faster and source-system load drops. 4.Add a client-side request cache Review how my client refetches data when users revisit screens or navigate back and forth, and find cases where it re-requests identical data unnecessarily. Introduce a client-side cache (or adopt a data-fetching library that provides one) keyed by request parameters, with sensible freshness and invalidation rules. Ensure mutations correctly invalidate affected cache entries. Verify revisiting screens reuses cached data and avoids redundant requests.

Copy and paste these prompts into Claude Code, Codex, Cursor, or any other coding agent. Run them one at a time, and test your app after each change. 1.Build a Toast Notification System "Implement a consistent toast/notification system for transient feedback across my app. Support distinct types (success, error, warning, info) with appropriate styling and icons, auto-dismiss after a sensible duration (with errors persisting longer or until dismissed), allow manual dismissal, stack multiple notifications cleanly, and position them consistently without blocking important content. Make them accessible via ARIA live regions and pausable on hover. Replace any ad-hoc alerts with this system. Show me the notification system and where it's now used." 2.Write Clear Helpful Error Messages "Audit all the error and validation messages in my app and rewrite the unhelpful ones. Make each message specific (what exactly is wrong), constructive (how to fix it), and human (friendly, not robotic or blaming) — for example replace "Invalid input" with "Please enter a valid email address like name@example.com". Avoid technical jargon and error codes in user-facing copy, and place messages where the user is looking. Show me the worst offenders and the improved messaging you wrote for each." 3.Establish a Modular Type Scale "Audit every font-size used across my app and consolidate them into a coherent modular type scale derived from a consistent ratio (for example a 1.25 major-third scale) anchored to a sensible base body size of around 16px. Define named tiers — display, h1–h4, body-large, body, small, and caption — and map each piece of text content to the appropriate tier based on its role. Refactor components to use these tiers instead of one-off sizes. Report the scale you established and how many distinct sizes you eliminated." 4.Add Fluid Responsive Typography "Make my typography scale fluidly between screen sizes instead of jumping at breakpoints. Use CSS `clamp()` for headings and large display text so font-size interpolates smoothly between a minimum (mobile) and maximum (desktop) value based on viewport width, with sensible bounds so text never gets uncomfortably small or large. Apply this primarily to large headings where the size difference matters most, keeping body text at a stable, readable size. Show me which text styles you made fluid and the min/max values you chose."

Copy and paste these prompts into Claude Code, Codex, Cursor, or any other coding agent. Run them one at a time, and test your app after each change. 1.Add a Content Security Policy “Add a Content Security Policy to my app to limit the damage of cross-site scripting. Start by restricting script, style, and resource sources to trusted origins, eliminate or tightly control inline scripts, and set the policy via response headers on every page. Begin in report-only mode if needed to find violations without breaking the app, then enforce it, and explain the directives you chose and what they block.” 2.Remove revealing server response headers “Review the HTTP response headers my app and server send and remove or genericize ones that reveal implementation details, such as server software names, framework identifiers, and version numbers. While you're there, confirm the recommended security headers are present and correctly configured. Make these changes at the application or server layer so they apply to all responses, and give me a before-and-after of the headers being sent.” 3.Validate and bound user regex “Audit the codebase for regular-expression denial-of-service risks. Find regexes that run against user-controlled input, especially ones with nested or overlapping repetition that can backtrack catastrophically, and rewrite them into safe linear-time patterns or replace them with non-regex parsing. Add input length limits before regex evaluation and, where supported, a matching timeout, and tell me which patterns were dangerous and how you fixed them.” 4.Block server-side template injection “Audit my server-side templating for template injection. Find any place where user-controlled input is concatenated into a template or passed where the engine will evaluate it as template syntax, and refactor so untrusted input is always supplied as data to a static template, never used to build the template itself. Confirm the engine's auto-escaping is enabled and that no user input can reach template evaluation, then report what you found.”