Day 2 / 07 / prompt
AI Security Review
Ask AI to check for exposed secrets, missing validation, unsafe access, and risky assumptions.
Security review guide
AI security review
Types of risks to check
Use these prompts before deployment. Ask AI to explain each risk in simple language, then decide what needs to be fixed before sharing the app.
Secrets and keys
Passwords, API keys, or private tokens accidentally placed in code.
Check this project for exposed secrets. Look for API keys, private admin keys, passwords, tokens, and .env values committed into code. Tell me exactly where each risk is and how to move it to environment variables.Input validation
Forms accepting empty, incorrect, or unsafe values.
Review the forms and submit functions. What fields need validation? Check required fields, length limits, allowed values, and clear error messages. Suggest beginner-friendly fixes.Database access
Users being able to read or change records they should not touch.
Review how the app reads and writes Supabase data. What access rules are missing? Explain what Row Level Security means in simple language and suggest safe policies for this app.User permissions
Every user seeing admin actions or reviewer-only controls.
Check the app for actions that should only be available to certain users. Identify admin, reviewer, and requester actions, then suggest how the interface and backend should protect them.Error handling
The app failing silently or showing confusing messages.
Review the app's loading, success, empty, and error states. Tell me where a user might get stuck and suggest clearer messages or fallback behavior.Deployment settings
The live app missing environment variables or using the wrong project settings.
Review the deployment setup for Vercel and Supabase. What environment variables are required? What should I check if the app works locally but fails after deployment?01Ask AI to look for riskBefore deploy, use AI as a second reviewer for common mistakes.
Steps
- Ask it to check exposed secrets.
- Ask it to check validation and access rules.
- Ask it to list risks by severity.
02Check secrets and environment variablesKeys should be stored in the right place and not committed to GitHub.
Steps
- Confirm .env.local is not committed.
- Confirm private admin keys are not written inside browser code.
- Confirm Vercel has the needed public environment variables.
03Fix or document findingsA review is useful only if findings become decisions.
Steps
- Fix simple issues immediately.
- Retest the app after each fix.
- Write down anything that needs human review later.