Security Prompts

This pack is free training material for vibe coders who want to secure the application without turning every change into a rewrite. Each numbered file is a short, focused prompt for one control. Use main site, admin site, and API as neutral surface names. Do not insert product names unless the codebase already requires them.

How To Use

1. Pick the vulnerability class first, then open the matching prompt.
2. Paste only that prompt into the AI unless the change crosses controls. Short prompts produce less chaos.
3. Make the AI map affected routes, middleware, handlers, models, and tests before editing.
4. Reject fake fixes: UI-only checks, unchecked middleware installs, regex theater, logs full of secrets, and anything that cannot be verified.
5. After implementation, require proof: tests, curl output, security headers, denied requests, sanitized errors, or database evidence.

Non-Negotiable Training Rules

• The AI must state what it is fixing and what it is explicitly not fixing.
• The AI must not rename routes, payload fields, database columns, exported functions, or public contracts unless the prompt specifically asks for a migration.
• The AI must preserve input and output types unless it analyzes upstream and downstream callers.
• The AI must not claim coverage without naming the exact files, routes, modules, or tests.
• Security controls must fail closed for sensitive paths and fail with safe client messages.

Prompt Map

Theme	Files	Use When
Input trust boundary	01, 02, 16, 20, 23	Data enters the application from users, clients, gateways, or RPC.
Browser and transport	03, 04, 17, 19	Browsers, cookies, headers, proxy trust, or cross-origin requests are involved.
Identity and sessions	05, 07, 11, 21	Login, JWT, OAuth, password storage, MFA, or admin authorization is touched.
Abuse and availability	08, 15, 18, 20	Brute force, scanners, uploads, duplicate params, or expensive routes are in scope.
Observability and incidents	06, 09	Errors, audit trails, SIEM, or detection engineering are involved.
Data protection	10, 12, 13, 18, 22	Sensitive data, storage, SQL, uploads, rich text, or least privilege is in scope.
Authorization	14, 21, 22	Users, tenants, admins, roles, scopes, or object ownership matter.

Files

File	Topic
01-zod-input-validation-prompt.md	Boundary input validation
02-uuid-param-validation-prompt.md	Route identifier validation
03-helmet-security-headers-prompt.md	Security headers
04-strict-cors-config-prompt.md	CORS allowlists
05-secure-authentication-prompt.md	Sessions, JWT, OAuth, OIDC
06-error-sanitization-and-logging-prompt.md	Safe errors and diagnostic logging
07-bcrypt-password-hashing-prompt.md	Password hashing
08-rate-limiting-prompt.md	Abuse throttling
09-siem-event-logging-prompt.md	Security event telemetry
10-secrecy-mode-encryption-prompt.md	Application-layer encryption
11-multi-factor-authentication-prompt.md	MFA and step-up auth
12-database-integrity-structure-prompt.md	Query safety and constraints
13-server-side-sanitization-prompt.md	Rich text sanitization
14-idor-prevention-prompt.md	Object authorization and IDOR
15-exploit-payload-scanner-prompt.md	Exploit payload screening
16-recursive-auto-sanitization-prompt.md	Recursive no-HTML sanitization
17-secure-session-proxy-prompt.md	Sessions, cookies, proxy trust
18-mime-type-upload-allowlist-prompt.md	Upload allowlisting
19-csrf-token-enforcement-prompt.md	CSRF protection
20-http-parameter-pollution-prompt.md	Duplicate parameter handling
21-oauth-bearer-admin-authorization-prompt.md	OAuth, bearer, admin authorization
22-database-read-views-least-privilege-prompt.md	Read views and least privilege
23-protobuf-grpc-schema-security-prompt.md	Protobuf and gRPC hardening
security-implementations-walkthrough.md	Application-agnostic walkthrough template

Use Multiple Prompts Only When Needed

Some work crosses controls. Examples:

• Login hardening: 05, 07, 08, 09, 11, 17, 19.
• Admin route hardening: 05, 09, 14, 21.
• Upload route hardening: 01, 08, 14, 18, 06, 09.
• Rich text feature: 01, 13, 14, 06, 09.
• gRPC service: 05, 08, 09, 14, 23.

Verification Standard

A finished security change must answer four questions: What attack is mitigated? Where is enforcement located? What proves it works? What still remains risky? If the AI cannot answer those, it did not finish; it decorated the codebase.